I blame the vague job descriptions. It is a bit like granting any application access to everything on the system. What could possibly go wrong?