Don't you have to give Jenkins the same credentials and attack surface that you would have had to give to AWX/Tower? With the Jenkins model, can't someone just

Don't you have to give Jenkins the same credentials and attack surface that you would have had to give to AWX/Tower? With the Jenkins model, can't someone just add a job that dumps the execution environment, and get all your credentials?