People who send documents containing someone else's personal data — HR and payroll staff, paralegals, accountants, clinic administrators, anyone submitting a résumé or a contract by email.
They cover sensitive fields with a black rectangle and believe the document is safe. The characters stay in the file and can be copied straight back out.
A free online PDF editor that uploads the file to a stranger's server, or Acrobat's rectangle tool, which is the wrong tool and does not remove anything.
The exported file provably has no hidden characters — text extraction and a raw byte scan both come up empty — and the document never leaves the machine, because there is no server to send it to.
Nobody searches for this until after they have been burned, and the people most at risk do not know they are at risk.