The difference is it would be likely inconsequential if a the cloud resource running this was compromised. There’s no direct link (at least there shouldn’t be)

The difference is it would be likely inconsequential if a the cloud resource running this was compromised. There’s no direct link (at least there shouldn’t be) to a work machine, which might have credentials or itself VPN information for an employer. Yevgeny did exactly this. He compromised a web server running Apache or something, used that to brute force his way into a networked work machine, which took weeks, but went undetected. That machine turned out to be the physical host the VM running the web server was on. Then he used the work machine to break into LinkedIn using credentials and VPN profiles found on the iMac. This vector would have been impossible had that open server not been running so close to the work machine.