I think you’re right. A single desktop, unless it is either someone in a position of power or access to trade secret files, is not a time effective attack vector.

A server on the other hand can access all of that stuff across an entire organization.