Let's say I log in to gmail on untrusted computer using two factor auth in Google Chrome in incognito mode.
Hypothetically some virus can read my email after this even without knowing password (.dll hijacking, non legitimate extension running in incognito) while I am logged in.
When I try to logout it can emulate sign out but actually it will not send logout request to Google servers and cookies which has been set in incognito mode can be stored somewhere and used again.
The only way to avoid this (as I think) to log in on trusted computer and click button 'Sign out all other sessions'.
Am I correct?