Well for one thing, with triple-stores it's not uncommon to expose an unsanitized read-only query engine (usually SPARQL), usually harmless because none of the data is secret. That goes out the window if you're actually storing business-sensitive stuff in there.

Aside from that, I guess there's theoretically nothing stopping you from using the triplestore for usernames/passwords (I hope you mean salted passwords) but sheesh, talk about killing a fly with a bazooka.

To be fair to those colleagues, it might have been less about them being clueless, and more about them wanting to offload work to my team, lol.