This is how they are
I don’t really like it when people think this. Every group of humans has people that would do this given the chance. Otherwise I agree, that Russian leadership really doesn’t care what their soldiers are doing, so the soldiers do what they want with zero accountability or fear of retaliation.
It still defends against one failure mode (the website gets hacked but you’re ok) but yeah, obviously if you get hacked and the hacker knows how to get your vault out then you’re 100% screwed.
My suggestion is always hardware 2FA, even though it’s not as mature as the other systems. Personally I have two Yubikeys (in case one breaks/gets lost) but it does mean that I need to add TOTPs to both of them each time I add a new 2FA.
Seems like the actual issue was that the law in question would let him be convicted even if he wasn’t doing these things and just being a nuisance. It’s not that he’s innocent, it’s that the law used is itself illegal.