This is correct, not all whales have good security awareness/practice. Here's an example of whale which rely on 3rd party, https://www.msn.com/en-us/money/news/a-coinbase-user-lost-11-6-million-in-under-10-minutes-after-falling-for-a-fake-notification-scam-the-us-attorneys-office-said/ar-AAQ9qai.