What OIDC in GitHub Actions doesn't protect you from

OIDC removes long-lived cloud keys from your CI, and that's worth doing. But it changes how credentials are issued, not who is allowed to ask for them — and most of the guardrails people add afterwards aren't guardrails at all.