Right now, we are pretty much guaranteed that they can access the data. As opposed to no guarantees that they can't.

I'm not clear the point of your post. Is it to say that what we had before is not guaranteed safe, so let's do this worse centralized thing because reasons?