They are also a far more interesting target because of their size. Imagine downloading all customer information of paying pornhub clients. Assume it holds basic information (name, address, email, payment info), and not any usage data.

I could use that data to extort at least 10% of those people easily (religious people, celebrities, politicians, etc). This is disregarding the price that I'd get for just leaking the other 90%.

Now imagine the fallout of somebody downloading the same info for a local brewery, a big tech company like Atlassian, a household brand like Staples, or even great big Amazon.

The fewer databases storing my banking info, the better.