Even if all their data is within Redshift, you can still control access in a way that is more fine grained than just "everyone has access to everything"

See the docs -> https://docs.aws.amazon.com/redshift/latest/dg/r_GRANT.html

Perhaps some people have legitimate reasons to access some sensitive info, perhaps not. But not _everyone_ needs that access anyways.