As somebody who used to breach them for rewards. I concur with your reasoning, but I imagine their security is much better than it was half a decade ago.

They don’t store the ID.