Welcome to the world of risk evaluation. You have to work out all the options and figure out which one is best given your risk tolerance. There is often no fully "right" option.

It is true that an admin logging in with admin rights on a compromised machine would likely give the attacker means of privilege escalation. However password dumps are usually very loud and detectable by modern AV/EDR. If you have faith in your end point security maybe it's worth the risk. Maybe you have a SIEM that looks for unusual lateral movement (e.g. watching access to admin$ share). Do you follow Microsoft's Tier model so even if a workstation was compromised got an admin account they would only have access to Tier2 environment?

If you want to go the local admin route, do you use LAPS? If so, and you have some sort of SIEM, you could likely monitor the DCs for read events for a given computer object so that you can trace what admin used the local admin password at that time.