Exactly. I dabble in competitive assessment and the amount of times weve got competitors data because they didnt flatten a file is astounding. The one we try every time with moderate success is checking every picture to see if you can "uncrop" it. So many times the rest of the picture is actually in the file and the crop is just for display purposes. Most of the time the rest of the photo is useless, but ill never forget the time we got the whole process map for their upcoming production schedule

FWIW they've always been bad at redacting things, this has happened before with other documents IIRC

I don't believe it's a security risk either, however it's considered a secure token/crediential, so those aren't supposed to be given public.