You may have rate monitoring on the decryption requests, watching the traffic flow to the servers fronting your encrypted store. An attacker is forced to eithe

You may have rate monitoring on the decryption requests, watching the traffic flow to the servers fronting your encrypted store. An attacker is forced to either exfiltrate the data slowly (so the surge isn't noticed) or alert ops monitoring that the decryption service is unusually active. Defense in depth raises the difficulty in going unnoticed and raises the time it takes to succeed.