I run a self-hosted installation in pretty exotic setup, few ghost instances running on Nginx and WP instances via php-fpm. I use localhost mysql db server, with multiple dbs, in order to be able to separate them later, as some projects will grow and some will not, so I can scale\cloud db as time goes.
Ghost install creates DB user, given the root mysql admin, however “ghost uninstall” command leaves DB user it created.
So I ended up with this:
this creates possible vulnerability risk, with very low but still noticeable probability, since I guess, no XKCD-936 style passwords are generated, but most likely some pseudo-random.
And also unnecessary resources are wasted.
Also a good practice to leave no traces in system.