Closing a window does not revoke every account session. Each signed-in browser or device has its own session, and another device can remain authorized after you close the one in front of you.
Use the account's active-session controls to revoke the unwanted session or sign out other sessions. Check the confirmation rather than assuming a closed window completed the action. This controls Console account access; WhatsApp linked devices and integration keys are separate. If a revoked Console session still performs an authorized action, report the action and time to support without sending cookies or session tokens.