TPMs / secure enclaves can (in theory) prevent sessions or cookies from being stolen. Not claiming there aren't other attack vectors though.