Staging environments that use realistic or copied production data are particularly dangerous. An attacker who finds an internet-accessible staging environment with weak auth may be able to access real user data — not just test data. Data copying from production to staging for testing purposes is common and creates a second, less-protected copy of sensitive data.
Cloud deployments make it trivial to give any service a public IP. A developer spins up a staging environment for a client demo, assigns it a public IP, forgets to remove it afterward. An infrastructure change opens port 443 on a staging environment that was previously internal-only. A misconfigured CDN routes public traffic to staging. Each of these creates an externally accessible environment the security team doesn’t know about.