Right, just because someone can't sneak out usernames and passwords doesn't mean they can't cause inaccurate results in their favor, like a glowing recommendation for a big bank loan.

Or heck, just a plain old money transfer. I guess it is an exfiltrating vector of sorts, just not for data ;-) Banks can reverse such transactions of course, but cryptocurrency transactions not so much.