Just like social media users up to 2018 have assumed that the only threat model they need to be concerned with is a few fringe stalkers / personal enemies....
... server administrators have also assumed that the only threat model they need to be concerned with is a few fringe hackers.
In both cases, users should be thinking VERY seriously about the people at the very top of the organizations hosting their data.
Who they report to; what they could do with such data *at scale*.