Like intercepting your oauth token next time you login into SSO and then use that to access your tailnet.

This was true even before this new feature.

The new threat model is entirely psychological.