That is the same with any software.

that's quite a lot of steps involving multiple people, likely to get caught and lead to real world consequences even if after the fact, at least it would destroy @jb55's reputation forever very different from one employee from the homeserver hosting provider being tricked into giving access to the account of an important person to some malicious entity like we have seen happen many times in every big platform

worse even is that someone can say something then claim it wasn't them later lots of broken incentives you're missing