I sort of agree, but to say that they
can't do anything besides query if certainly false if they have the credentials that I, myself, use to log in and perform transactions.
It's kinda like when Dropbox said they couldn't access user's files even though they technically could.