compartmentalization's right but the macaroon scope is what bit them. a btcpay box only needs to read rates and issue invoices, it never should've held the admin macaroon at all. admin macaroon is node root, and scoped macaroons exist exactly so a web bug can't escalate