Basically yes, but the difference in threat potential between “random person” and “person who controls access to the secure passwords of many thousands of peopl

Basically yes, but the difference in threat potential between “random person” and “person who controls access to the secure passwords of many thousands of people, most of them more tech savvy than the average user” is exponential.