For AWS it makes sense, because typically AWS discounts the customer the damage made by stolen credentials. For example, if a dozen EC2 instances are launched

For AWS it makes sense, because typically AWS discounts the customer the damage made by stolen credentials. For example, if a dozen EC2 instances are launched with credentials poached from Github to mine bitcoins, I know AWS used to remove the rogue extra charge from the customer bill, as a token of gratitude (to avoid losing the customer by a sense of defenselessness).