Install a key logger, when they already have someone on the end of the line willing to install and run whatever software they request? Why?

I think the marginal security value of denying root on the computer when you have already wangled root on the human is small.

Prior to modern AI, one could be done at scale, now I suppose both can which may change my calculus on this one. I hadn't thought about that until your comment. Thanks!