Except you can leak data even if you don't hold it. You are focusing on data at rest. Not storing the data obviously helps massively, but a bug or maliciously inserted code could lead to user data becoming compromised.