Common sense. You demonstrate on low profile accounts so when the “client” pays you for the real job, you still have access to the vulnerability.