I don't think it's quite so clean as that though. All data is customer data from the perspective of the service; it may in fact be employee data, but employees

I don't think it's quite so clean as that though. All data is customer data from the perspective of the service; it may in fact be employee data, but employees are also people who's privacy should be respected. And even if it doesn't contain data about any people, breaches often involve attacking multiple services to leverage increasing access. So you're putting a vulnerable app into an ecosystem of software, which doubtless includes sensitive days, and increasing the vulnerability of that ecosystem.