If you have a hardware token, not on the computer.. and use that as part of your VPN, if your computer is compromised, your account won't be able to be used to reconnect to VPN while you are afk without that hardware token... if the software/key are on the machine, they have your password, and the generator for 2fa... they don't even need your machine anymore... that is definitely less secure.