Aren't both of these equivalent though?

(I would think the point may be that a compromised email, doesn't provide access later. Both these scenario are equally vulnerable then?)