It's inaccurate, but personally I find the idea of successfully impersonating a service such that users think they are talking to the legitimate service is a mu

It's inaccurate, but personally I find the idea of successfully impersonating a service such that users think they are talking to the legitimate service is a much scarier thing to happen than for a service to get hacked, which can be a one-time (and often minor: e.g. if only part of the system got hacked) thing.