As I understand it, there's no way to have the feature of "remember me" on the login box allow skipping 2FA without this. Anywhere they could put it while still allowing a no interaction login would be just as vulnerable.

The primary way of attack was to trick a steam user into either uploading the token file directly, or trick the user into running an executable that uploaded it silently. If you're already tricking the user into running an executable you design, there's not much left that can be done to stop this since such an executable could reach inside the running steam process and read whatever data it likes.