Eh, if I have a document somewhere that explains how to access all of my personal accounts and finances, it's a not-very-well-known target for a very targeted attack with limited payoff.

If I'm running a service that manages these documents for thousands, millions of people I know have a well known target appealing to a wide array of actors with nearly unlimited payoff.