This is dramatically unlikely for FIDO2 MFA services. It’s possible, but would require the device you’re using to remain connected to both the vault and the attacker infrastructure long enough for the data to be scraped. It happens, but nowhere near as frequently as just stealing the login credentials and using them asynchronously from the origin.

The strawman here would mostly apply to high value targets, which most people aren’t. At the scale of the internet, most cybercriminals are going to pivot to stealing accounts that don’t require additional investment to harvest. It’s simple economics. Having MFA is an essential part of using the internet for anything you actually care about.

Strong passwords are rapidly becoming worthless when we’ve been building ever more powerful compute farms for several decades. What used to take months or even years to crack in 2010 can be done in seconds today. But all of that info neglects that it’s irrelevant because most passwords are lost due to social engineering, malicious software, or the leading cause…… password reuse.