It is a breach of Least Privilege, which is a fundamental cybersecurity principle. An egregious error on Coinbase's part. Anyone with even just a Sec+ (i.e., me) knows this.