Doing absolutely everything useful with that data is "one extra attack vector". That is not any kind of a persuasive argument in itself.

It's also replacing all the personal information stores from thousand applications and websites you have previously registered, or would have to. So arguably it's thousand attack vectors less.