Every project handoff has a moment where one side holds the credentials and the other side holds the invoice. On most jobs that moment lasts an afternoon. On the jobs that go wrong it lasts weeks, and the two parties come to describe it very differently.
Studios here know the shape of the bad ending. A final invoice sits unpaid, so the staging site comes down or a DNS change waits, and the client reads that as leverage being applied to them. Or the reverse happens. A contractor who left six months ago still has an API key nobody rotated, logs in to grab a portfolio screenshot, and now there is an access event in the logs with a former employee's name on it. Both versions start as contract disputes. Both versions can stop being contract disputes. Shops that subcontract add a third body to the same picture, because the person holding a credential is often not the person who signed the agreement.
The line gets crossed when someone files a report instead of a demand letter. After that the vocabulary changes. Unauthorized access. Obtaining money under false pretenses. Theft of property that happens to be a database. The matter is no longer two businesses negotiating a number, because the state becomes the party that decides whether to proceed, and a client who later regrets making the call cannot withdraw it. Detectives ask developers for logs and chat exports, and a studio that kept nothing is in a worse spot than one that kept too much. Interviews get requested. Phones get imaged. Work stops while all of that happens.
For a small shop the protections are procedural and dull. Put offboarding in the statement of work: what transfers, on what date, into which account the client owns. Rotate keys at delivery rather than whenever the relationship ends. Never log in to a former client's admin to check something, no matter how innocent the reason sounds in your head. It is also worth knowing in advance that a Las Vegas defense practice whose site covers fraud and white collar allegations is there, because the hour after a detective leaves a voicemail is the hour when technical people talk themselves into trouble by explaining.
Engineers usually grasp this faster than founders do. Anybody who has run a production incident knows the log written during the event beats the account reconstructed a month later from memory. Disputes over work behave the same way. Keep the record while the project is live, and keep it somewhere the client's own account cannot delete.