They often treat directory completeness as the same thing as identity visibility. In reality, many of the highest-risk access paths are application-native, ephemeral, or inherited from integrations that never pass cleanly through central IAM records.