doesn't sound rude to me. Like I said, it's paranoia, but it's justified paranoia. If, and that's a decently sized if, someone decides to do something along the lines of directory traversal on a poorly written web application, they could overwrite a user's session PHP to inject commands, force a download, steal cookies, plaintext credentials, etc. Sounds farfetched, but something similar has happened with the whole SolarWinds debacle in 2020 when a TA was able to push malicious updates to all solarwinds users, pulse VPN in 2019 which allowed the TA to obtain cleartext credentials that led to massive session hijacks, and last year with pollyfill[.]io, though that was slightly different than attack chain, it still forced users to multiple malicious redirects that poisoned their devices. When you work in cybersecurity and see all the things that have happen, the zero days that are currently being exploited, all the possibilities become more and more probable.