There are tons of situations where not having everything on the server is beneficial. A hack will barely get them anything, neither a warrant or a bored employ

There are tons of situations where not having everything on the server is beneficial. A hack will barely get them anything, neither a warrant or a bored employee. Of course any of those situations could result in an active tap that stores everything. But that is orders of magnitude more effort and still doesn't get any history. Just minimizing the attack surface.