you forget, they can just capture all data from the switch port.