Exactly. There are assumptions in every threat model, and violating them isn't a legitimate use case because someone "forgot to protect" their private resource.

Exactly. There are assumptions in every threat model, and violating them isn't a legitimate use case because someone "forgot to protect" their private resource. "Door wasn't locked" isn't an excuse.