I think these same people failed to learn the lessons of the 9/11 commission or have horse blinders on so they only apply those learnings to air travel or military contexts.
Think you aren’t worth anyone’s time to hack? Assume hacks are 100% automated — they aren’t targeting you, but if you are vulnerable they won’t do anything to avoid you.
Think you aren’t the biggest target? Assume it costs no more to hack the marginal device / server / Twitter account than it costs to send a single email. Assume the person running this hack is being paid a low wage in the poorest country - your coffee money is a decent day’s wages for them.
Think you have no assets to lose? Assume they can force you deep in debt to the extent that some greedy financial company will offer them a large loan in your name.
https://en.wikipedia.org/wiki/We_begin_bombing_in_five_minut...
Time to update that, then!
Although you can't do anything to the systems that this agency deals with via the back end to this website, the scope of abuses that someone could engage in if they had these credentials is quite broad, ranging from "Agency XYZ endorses PQR" to "Agency XYZ will begin action against LMN".
Or, if you can't see the implications of that ability, consider that there's an entire cult of folks in the US that has some pretty questionable beliefs based on the mere assertion of "clearance" by an anon poster on a chan board... imagine how damaging it would be if those assertions could be "demonstrated" via an agency account?