There is more to a public web service's digital attack surface than what it looks like in a browser. Correlating and using breached passwords from someone's unrelated accounts to their self-hosted service login portals, for example.