How can JWT be compromised in localStorage?

I've googled and readed a lot of articles for jwt security. A lot of people said that it is not safe to save the token in the local storage. But nobody actually gives some example of that IN ACTION. For example how can somoene make XXS attacks with jwt in the local storage ?

The only example that i found is this one:

https://www.youtube.com/watch?v=g21uHNIIewM

But here he at 3:10, he is explaning not about xss attack,but possible scenario if somoene acccess to my pc if i leave it unintentionally open, he can copy my jwt from localstorage, save it and then when he paste to his pc at home he has acceess to everything for example admin-routes.

But i didn't found an example for that, how can somoene directly make something bad with the jwt token. For example i have web app, the users needs to register and after that login. I have this payload in my JWT, where i will give admin roles only to specific users ( with migration only at the beggining i give admin true to some users,after that for every other new registerd user he gets admin - false )

{
  "name": "John Doe",
  "admin":false,
  "id":1
}

When user logs in i save the jwt sended from the server in the local storage for example.

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiSm9obiBEb2UiLCJhZG1pbiI6ZmFsc2UsImlkIjoxfQ.GY9qxlilipXdndTGHWGcI-BDIkZFV5xjxOW-EVTHCQs

I have admin panels where i am hiding the routes for them, and preventing access if the user role is not admin - so first i read the payload from the stored jwt

let token = localStorage.getItem('token');
let jwtObject = JSON.parse(atob(token.split('.')[1]))
// and i get
{name: "John Doe", admin: false, id: 1}

i check in the route

if(jwtObject.admin == true) {...};

Let's say some user wants to do something bad with my web app.He sign up, he logs in, he get jwt payload where admin is false. He can also view his token for example

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiSm9obiBEb2UiLCJhZG1pbiI6ZmFsc2UsImlkIjoxfQ.GY9qxlilipXdndTGHWGcI-BDIkZFV5xjxOW-EVTHCQs

in the local storage. How can he do 'something' so he can change the payload it self - make admin to be true, even it is sended from server as false, and after that he would have access to all routes for the admin panels ?

I tagged here angular and react as well, so i will hear opinions and examples from more people regarding on the java script tools they are using.