I had the same question and this article was really helpful in explaining the threat models

https://www.deloitte.com/nl/en/services/risk-advisory/perspe...