I agree. My point was more in terms of surface area. Sending data to a party with a reputation to uphold and resources to do proper data handling is still better than sending data to 10+ parties with little or no reputation and/or resources to implement security measures.