Think about what an attacker's budget used to look like. Working a broker portal meant a skilled person spending days on reconnaissance, credentials and the application's logic. That cost forced a choice, so most attackers made the same choice defenders did and went for the obvious door.
An agent doesn't have to choose. It enumerates what's exposed, replays logins leaked from other breaches, maps the APIs behind them and checks whether one customer's session can read another customer's data. When it gets blocked, it tries another door. The cost is now a few hours and a few thousand dollars to try all the doors...
https://xint.io/blog/side-door-problem