I know we've been down this path before, but I'll do it once more. It doesn't need to be a major criminal act or even really a criminal act at all and you don't need intelligence to pull it off. If a CM has an IPad with my itinery, where I'm staying, where I'm from, where I'm eating dinner each night, what park I'm going to be in, what rides I'm going to be riding, etc... It's just creepy and unnecessary to me. Here's a simple hypothetical example of how it can be creepy. A 19 year old girl has breakfast at Ohana. The waiter attempts to engage in a little back and forth conversation, maybe some flirting. On her way out of the restaurant he asks her if she wants to get together later that night. She politely declines. Guess who shows up that night at the restaurant she is having dinner or the ride she has reserved. It's just creepy. If she's 16 instead of 19 it makes it even worse. If the guy shows up at her room it could be both creepy and dangerous. He doesn't need to steal her identity or even her credit card number.
I'm sure the vast majority of Disney CMs are good honest people and this is a highly unlikely scenario but it only takes one bad seed. Why make that kind of info available to people who don't need it to do their job.