The question is not why this data exfiltration works.

But why do we think giving a random token sampler, we dug out through the haystack, special access rights, which seems to work most of the time, would always work?