Yes it's a big problem. In theory hackers can use social engineering to trick people into downloading malicious Office documents that download a keylogger in the background. Win Defender and Win Firewall won't help against this fileless-malware. If they are able to capture username and password they can then perform a SIM Swapping attack in order to bypass 2FA. And now they can plunder your online banking or cryptocurrency account. I actually saw a show on MTV called "True Life Crime" about hackers that stole millions of dollars.
