I was referring to the root accounts in your organization. The blast radius is more limited, but still a root account that has access to everything within that AWS account.