as one of the comments on that post said, even easier is they just call the bank pretending to be you and get them to reset your password. they don’t need any of your devices or vaults in that case, just some easily discovered personally identifying info (which was probably leaked in a data breach)