Interesting. While Teams predated the pandemic, I suspect there was a lot of pressure to pump out new releases during Covid, and maybe some steps were skipped.
If I read correctly, this only impacts the desktop app and requires local access. The big flaw is a combination of the tokens are stored in clear text, in non-protected space, and can be re-used. All this points toward using the Electron framework, which is basically JavaScript - client-side scripting. JavaScript is useful for building non-essential functionality, but confidentiality and integrity are inherently difficult to ensure with it. The problem is these script frameworks are popular because it is an easy way to make cross-platform "applications." Again, I suspect market pressure pushed them in this direction.
As to Microsoft's "no big deal" response. While it is true, that a pre-requisite compromise would have to happen (an attacker get access to local files), this has been the problem that has plagued Microsoft for seemingly decades. Their model is all about integration - between applications but also between those applications and the OS. While it can work, and is working much better today than years ago, it is still a bit of Tootsie-Pop design where if an attacker can crack the thin, hard shell, it's all soft and gooey inside.
