Right, but speaking for the dev crowd, plenty of us have public identities. Anyone can find my email trivially by scraping github. If you have a public online identity in the first place, it’s far preferable to treat your public-facing email as public information, rather than to rely on security by obscurity and assume no one will ever discover it.

The only glaring risk from an online attacker is credential stuffing, and falling victim to that one is a skill issue tied right back to assuming your email address won’t become public.

I'm the only daychilde on the internet. It's trivial to find my name and my wikipedia entry.

Nobody's murdered me yet.

You could've also simply gone through my post history and seen that I switched accounts like two years ago. Both of my accounts were also admins of my instance at some point.

Legally, of course it’s PII — but is it sensitive information if you treat it as public and distribute it yourself?

I’m speaking to the functional cybersecurity angle, not the semantics of PII.