Others already explained why. Matrix.orgs postmortem includes a real world exploitation: https://matrix.org/blog/2019/05/08/post-mortem-and-remediati...