You answered your own question. If a site works this way it is risking the privacy of user data on itself, but at least it isn't endangering the credentials whi

You answered your own question. If a site works this way it is risking the privacy of user data on itself, but at least it isn't endangering the credentials which may be useable to attack other sites.