I think they're just counting on coaching the person through whatever privilege escalation is required when the trojan wants access to the passkey.