Until you try to do something like zero a buffer to clear sensitive data just before it goes out of scope, and find that there's no way to do so that compilers actually have to obey.