I don’t know about Coinbase but Kraken has protections such that even if you had a cookie you couldn’t withdraw funds, in addition to security key/OTP support. Apparently people still don’t understand hardware wallets either. Nobody deserves to be a victim of theft but this is pure negligence. Don’t handle crypto if you don’t know how to handle crypto.