I think the reason for the original wording, which I pasted from the post it was coined in, is to make it more accessible than this, more obvious what you need to look out for.
"Untrusted input" sounds like something I'm not gonna give an agent, "access to untrusted content" sounds like something I need to look out for. "Privileged access" also sounds like something I'm not gonna give it, while "access to my private data" is the whole reason I'm using it.
"Exfiltration vector" may not even be a phrase many understand, "ability to communicate externally" is better although I think this could use more work, it is not obvious to many people that stuff like web search counts here.
Pro tip, sites don't have the means/motivation to challenge a user's assertion that they're in France (GDPR) or California (CCPA). Just pick a Paris address and demand a GDPR Data Subject Request (DSR) to delete your data.
Seems plain that the PR Release was crafted with intent
reply