@jntesteves An attacker might have access to backups, or might be able to run code as an unprivileged user. These two (and countless others) scenarios grant an attacker read data without being even close to "full access".