That's what gets me too. It feels so easy. Just don't store the source data. They usually say they don't, they claim it's deleted quickly or never saved to disk at all or other stuff and its always lies. Just don't save it and there's no attack vector. Same thing with plaintext passwords. The amount of password leak attacks I've seen in recent years is 0 (though I'm sure they're still around). Stored IDs and PII for verification is uncountable