For companies. Here's a good summary by Karl Denniger of what the real problem is, using the CDK Global cryptojacking as the example. tl;dr

But in a corporate environment you, as a user, by design should never be able to see Bob's data unless Bob is in some way subservient to you. Ever. The circumstances under which you can alter that data are even more-restrictive, obviously. There are bugs in all software that can be exploited, in some cases, to violate this separation. But these "cryptojacking" attacks are typically not from that sort of cause; they instead come about because someone authorized the machine to use elevated privilege and thus get "beyond" that individual user's data set.

And let's not forget when Sony had user data and passwords stored in an unencrypted text file.