You are understating the main difference a bit.
By using a bunker, the client can temporarily abuse the keys for things I explicitly allowed but bunker can still hold taps on things I never allowed or throttle the things I did allow in ways the client cannot know.
Bunkers so far are not that sophi...