Answer
It can destroy logs, timestamps, malware samples, and other evidence needed to determine what data was accessed and whether the compromise remains active.
Explanation
Containment and preservation need to be balanced. A prepared incident process should define how to isolate systems without unnecessarily destroying evidence.