I'm just theorizing. But let's say the site gets compromised for a few days/weeks and they don't find out.