The harms that get counted are the ones somebody already had a process for. Biometrics and medical history generate no report at all.
Credit monitoring is a product designed for the population that files the most reports — and useless against a persuasive phone call about savings.
The harm is not identity theft. For a person on this list, the harm is being found.
Voice phishing into identity providers, then leak-site extortion. Active since 2020.