You are missing "having read the article". #1 MFA, IT computers never left unattended/accessible, even IT accounts had minimal permissions, "IT like" behavior on non-IT computer caused alert (so even if they got past all the above they would have got caught when they used, like the OA did).

Finally placing and retrieving physical devices/physically messing with machines is risky and luck based. It would be one of the last things you tried. As it was in the OA.

If IT are using laptops, their USB ports will be quite visible to the user and a new dongle will stick out like a sore thumb.

I believe the thing you're missing is known colloquially as 'antivirus'

I think GP was referring to a hardware keylogger - antivirus wouldn't help.