If the machine is stolen and someone changes your software (browser, CA, whatever), that only hurts you if the machine is later returned to you and you don't wipe it.

But this discussion was more about if the machine was stolen and the bad guys logged in to your online accounts from it.

In that case it is true they would have your OTP, but they shouldn't have your Blizzard password.