I think to persist the attack you need a persistent hardware device attached so a reboot doesn't reset things?

The thing is, can't you just stick a keylogger onto the machine at this point and get an equivalent compromise? I log you login and then use that to authenticate?