But I imagine having someone representing a foreign government watch you enter said credentials and then read your screen is A-OK, right?
Honest answer: it depends on their clearance.
First, nobody is ever permitted to watch somebody else enter a password since that kinda destroys the whole idea of a password.
Now then, the foreign representative almost certainly does not have Industrial Security Staff Approval (ISSA) clearance. That is "staff-like" access to a classified system, which amounts to you having the right to an account and the ability to log in to it -- the right to having your hands on the keyboard. ISSA is controlled as part of the clearance and classification regime. I for example had ISSA clearance on most USG TS/SCI (Sensitive Compartmentalized Information) networks for > 20 years. Even with ISSA you still must have need to know to access a particular Controlled Access Program (CAP). The automated access control system on the system gives or denies you access based on your userid. You can't break it by accident. If you break it by means of counter-measures, which is possible, you go to Leavenworth.
However, if the foreign representative has the lesser Industrial Security Approval (ISA) clearance for that system, then they ARE in fact permitted to look over the shoulder of an ISSA person with an account. It is up to the recognizance of the ISSA holder to use their judgment as to whether the ISA holder can see the data. It's counter-intuitive, but it's allowed. And indeed it is the way a foreign head of state, diplomat or technical expert is permitted to view data on a TS system. The ISSA person is never permitted to, for example, print out the data and then give it to the ISA holder. That creates a data spill, since the new holder could then theoretically spread the document further. Verbotten.
You may be hankering to point out that nothing prevents the ISA holder from retaining the information they've been shown in their head and telling somebody bad later. ISA is also limited to TS clearance holders. But yes, point taken. It's an art, and it's fraught. We've been doing INFOSEC for about 80 years and it's still a work in progress.
Bottom line: if what we see in the photo is real, it's a very serious security violation. Even if Vance has the same or even higher access than the person whose userid is being used, it does not matter. You may NEVER touch a system logged in as somebody else. You're literally not permitted to call for help in a medical emergency on somebody else's system; you must use other means. It's the only exception to the medical waiver I'm aware of. When somebody is having a heart attack, every other security measure is temporarily suspended. That's why firemen are allowed to put out fires and EMTs are allowed to enter facilities without having their IDs checked.
It is fun to talk about something I know about rather than pull it from my ass. For once.
Note everything above is unclassified and publicly available. As lax as I am on all other moral, ethical, and spiritual rules, I have seen enough intel over the years to treat classification as non-negotiably serious.
Thar be monsters.