Suitabe tokens for autologin?

In the end, nothing is secure enough to prevent all attacks, if there someone exist.
If you login your user with a "Remember-Token", the token should be completely random (obviously 100% unique), nothing related to the user.
So the possible attacker has to trial and error thousands of random tokens to get access to an account, whats nearly impossible.

But in case the attacker has access to the machine of your user, in any way you want, a Trojan maybe, he can read out the cookie data
and no master-unhackable-super-token can prevent that the attacker is getting into this account.