What is the main limitation of relying solely on internal loss data for operational risk capital modeling?