The upside is that it would only really impact their interaction with that specific site, not with anything else (unless there's opportunity for lateral moves b

The upside is that it would only really impact their interaction with that specific site, not with anything else (unless there's opportunity for lateral moves because of SSO or the site hosts email and so they could hack password resets or something). My dream scenario would be this happening to an in-company administrative user with the keys to the kingdom. Imagine an ad-ridden site like Fandom.com getting hacked in that way.