You are missing "having read the article". #1 MFA, IT computers never left unattended/accessible, even IT accounts had minimal permissions, "IT like" behavior on non-IT computer caused alert (so even if they got past all the above they would have got caught when they used, like the OA did).

Finally placing and retrieving physical devices/physically messing with machines is risky and luck based. It would be one of the last things you tried. As it was in the OA.