If an attacker got root with recall they might not need to wait the user to type their password and risk detection. The information they want to know might be already in the recall database.