> Assuming they didn’t do anything incorrectly. Like secretly having a second password for customer support, or for law enforcement requests.

But if that’s secret and not leaked, an attacker wouldn’t be better off.