Even if that were not absolutely wrong¹ these days², if your risk is mitigated by being one of millions the damage done if you are hit could still be so high that you can't afford to³ knowingly take that risk.

--------

[1] if the credentials can be easily linked to the relevant account, cycling through them to see what useful stuff can be accessed using which is not difficult to quickly automate

[2] if it were ever right

[3] or your customers can't afford for you to