Using hive (including via MCE or ACM) to provision a VSphere cluster requires supplying VCenter credentials via a Secret in the same namespace as the ClusterDeployment that declares the desired configuration of the cluster. These credentials are echoed back once the cluster is provisioned via the ClusterProvision object that hive creates in the same namespace. It is likely that customers don't realize this, and may have RBAC allowing
ClusterProvision read access to users who would otherwise not be trusted with VCenter credentials.