There is currently a glaring security issue in QBO where a staff member with read-only access to customer lists (among other lists) can hit the "export" icon to generate an XLS file containing that data on the list page. To make it even worse, this export does not appear in the Audit Log. It's currently very easy for staff to steal company data in its current form.