Maybe I'm missing something here, but if usernames are treated as ephemeral, what's the threat model here?