Instead, it's a matter of understanding that most attacks involve several pivot points; and that these pivots are possible because we treat internal networks as if they are "safe spaces" where we can let our guard down.

Obviously it's impossible for compromising credentials to have no consequences -- if case, why do you have credentials?

For systems that only require a username and password to log in, someone else obtaining/guessing my credentials would have the consequence of someone being able to access my account. But if there's a second credential I have to enter in addition to the username and password, then someone trying to use the username and password alone would not be able to access the account.

Where I work, this second credential is the RSA token along with a PIN. But this could also be accomplished by using a client side TLS certificate on the work provided device or U2F with a work issued Yubi key.