Not prompted for 2FA when login from browser

Thanks Dave for the response and the links. After reading through and a bit of consideration, i think the information provided, though very useful -- thanks! -- just confirms a concern of mine, but I'll share some context first to make sure I'm being clear about the scenario in question:

Let's say for the sake of this discussion that I'm not asking about the security of my vault data (and yes, I'm familiar with the distinction between authentication and encryption). My focus for the moment is on the non-vault data tied to my 1Password account and the account-based capabilities or functionality that 1Password offers through the browser -- such as  'Manage Two-factor Authentication' (adding or removing second factors, such as hardware keys) or   Unlinking devices/sessions that are linked to my account -- both of which  (and more) are accessible when logging into an account on the 1Password.com website via a browser where the following are true:

1. The account has previously been logged into via that same browser - so the account password was presented, the secret key presented, and the authentication was accomplished solely by virtue of having presented a second factor of hardware (YubiKey)
2. Account/vault information has been transferred from 1Password to my browser instance and is now stored locally on my computer, along with the secret key, in one form or another on the local filesystem.
3. The 1Password browser extension has NOT been installed (by choice)
4. The hardware second factor is no longer required to authenticate and log in, because #1 & #2

The concern is, now that 1Password has deemed the hardware second factor is no longer needed because it has chosen its own locally stored copy of encrypted 1Password data to be the only 2nd factor required for login, it seems possible if not plausible that a malicious actor who has ...

(a)  acquired the account password, and

(b)  exfiltrated a copy of all 1Password-related data and/or session or state data persisted by the browser (e.g. cookies or other ephemeral data) that had been downloaded and persisted by my browser

... could log into my 1Password account (via another browser) and take any number of actions such as

(c)  unlink my devices/sessions, or

(d)  remove registered all second authentication factors , or

(e)  delete the account entirely.

Could they not take such actions?  I'm not saying it would be trivial, but if it's NOT possible, why is that?

In any event, if the response to this concern is something along the lines of 'The use case you've described, thin bread, can only occur if you're *not* using the 1Password browser extension, but is indeed addressed by using the 1Password browser extension and that is because __________ , "  then OK, good!  Would be glad to hear that. I might then reconsider my choice to not use the browser extension, and give it a go ... except for this other caution from 1Password about use of its browser extension :

• Limit your use of other browser extensions. A malicious or badly made browser extension could interfere with 1Password or attempt to expose your data. If you need to use untrusted extensions, consider using a separate browser profile just for 1Password.

From:

https://support.1password.com/1password-browser-security/

Which brings me back at my original concern: not being able to use the hardware 2nd factor already registered with 1Password  for any login subsequent to the initial site login /  authentication attempt, because 1Password trusts the presence of previously locally stored 1Password data as a 2nd authentication factor over and above the existing registered and previously required hardware 2nd factor device. It's interesting that is the case, since 1Password has declared what sounds like a resounding Yes to the value of using MFA:

"With MFA enabled, the attacker would still need your second factor – which you can choose to be a code from an authenticator app or a hardware security key – to sign in and unlock 1Password."

https://blog.1password.com/should-protect-1password-with-2fa/

Yes, exactly. I agree, and don't understand why the chosen implementation of hardware-based MFA support doesn't match what's being publicly asserted.

Thanks, again, for your consideration and guidance.