The key logger was on the employee’s personal non work issued computer. Not their work station. What location it happened in is irrelevant here because you can work remotely and the expectation is your work device is just as secure as it would be on site. Nothing happened on their workstation.

They gained access to the employees master password when the employee was using their personal device and that gave them access to the employees corporate vault. That’s where it’s odd because why would they allow their employees to share their personal and work vaults. Don’t quite yet understand that link. They should be two separate accounts and two different vaults.