With spare time at the rack, a technician plugs patch cords into every remaining spare port on the head and the top-of-rack switch, 'in case they're needed later.' What is the strongest reason not to do this?

Every live physical link is a potential path whether or not a path was intended. A cabled interface with link can carry traffic the moment the switch port enters forwarding state on any VLAN — default VLAN membership, spanning-tree reconvergence, or a well-meant later change can energize a 'dead' port, creating undocumented bridges between segments and even loops that the design never accounted for. Cabling only planned interfaces keeps the physical layer an honest picture of the design, with unused interfaces left unplugged and later left unconfigured or administratively down. Standby-power overheating through terminated sockets fails by mechanism: ports and passive optics show no such hazard from an unused terminated connection, and no such failure mode exists. Cables degrading and shedding dust fails by proportion: housekeeping such as dust caps is real, but it is tidiness, not the reason spare links are dangerous. The claim that an address-less appliance interface cannot carry traffic fails at layer two: Ethernet frames forward based on switching, not on the appliance's IP configuration, and an address-less interface in a default VLAN still receives floods and any traffic the VLAN carries. Exam caveat: the planned-interfaces rule pairs with leaving unplanned ports unconfigured so nothing can be activated accidentally. Operational check: walk the head's rear against the approved port map, remove every cable not on the list, and record the verified state as the as-built.