You also can't fully trust org members because valid / "Trusted" accounts can be taken over by nefarious actors as well.