Here's one potential scenario?: Over-zealous developers who think it's appropriate to log all function calls with parameters for trace level logs, or a framewo

Here's one potential scenario?: Over-zealous developers who think it's appropriate to log all function calls with parameters for trace level logs, or a framework with the same opinion automatically applies such tracing and logging over the whole code-base. No-one notices because no-one uses trace level logging, until one day another developer is tearing their hair out because they can't reproduce a bug that is only occuring on live. It's an urgent bug that needs resolution asap. So this developer turns on the trace level logging and eventually finds and resolves their bug. Being the careful person they are, they turn off the logging and go away happy. Meanwhile they've unknowingly produced a few gigabytes of log outputs which happen to include plaintext passwords. That's just one of many different scenarios where people acting in 'good faith' can still lead to bad outcomes. That is why a "PUNISH THEM!" attitude to this kind of incident is not helpful.