The threat model of an insider is wildly different to an externally facing vulnerability. That doesn't mean there is no risk - but removing a class of attacker is an extremely useful outcome