Impact

Not every attacker wants to steal something. Some want to destroy, disrupt or embarrass.

Destruction of data, denial of service, publication, manipulation of a process. Controls built purely around preventing exfiltration do not address any of it, and recovery capability matters far more than confidentiality when the objective is damage rather than theft.