Answer
The hub holds credentials to every spoke, making it a high-value target. Mitigate with least-privilege service accounts per spoke, network segmentation, short-lived credentials, strict RBAC and SSO on ArgoCD, audit logging, and possibly splitting sensitive clusters to a separate instance to reduce blast radius.
Real-world example The hub uses minimally-scoped, rotating credentials per spoke and strict SSO/RBAC to limit the impact of a compromise.