One of the top things an attacker does is use a compromised account to move laterally through the network. The more privileges the account has, the more damage an attacker can do. For this reason, you need to limit accounts to only the privileges required to function, and nothing else.
We know there are operational and organizational issues with keeping accounts clean of unneeded privileges. Over the years we’ve seen many accounts accumulating privileges that never get cleaned up. Then there is a security audit, ...
