Are there really many web services where an attacker having long-lived access gives them much more power than short lived access?
If someone gets short lived access to a control panel for something, there are normally ways to twiddle settings to, for example, create more user accounts, or slacken permissions.
If someone gets short lived access to a datastore, they can download all the data.
If someone gets short lived access to a control panel for something, there are normally ways to twiddle settings to, for example, create more user accounts, or slacken permissions.
If someone gets short lived access to a datastore, they can download all the data.
etc.