if www.host gets hacked (e.g. a bad wordpress plugin), it could spread to the matrix server running on a different host.