Yes

Unless you’re talking about local accounts, remote accounts are inherently remote by definition and additional attack vectors apply.