It doesn’t even have to be the same attacker. The attacker could just as easily sell the info to another attacker.

Plus, if the original vuln used to gain access is still open, there’s no reason why somebody else doesn’t find it later.