If malware is on the machine you are basically screwed anyway. A threat model where you happen to never authenticate with a service while you have the malware installed is not especially compelling.