When is `aws:PrincipalAccount` or `kms:CallerAccount` needed?

Question

What is the difference between the following two permission statements, assuming that they are used in resource-based permission policies in AWS?

1:

{
  "Effect": "Allow",
  "Action": "*",
  "Resource": "*",
  "Principal": {"AWS: "123456789012"}
}

2:

{
  "Effect": "Allow",
  "Action": "*",
  "Resource": "*",
  "Principal": {"AWS: "*"},
  "Condition: {
    "StringEquals": {
      "aws:PrincipalAccount": "123456789012" # or "kms:CallerAccount"
    }
  }
}

The documentation for aws:PrincipalAccount doesn't have much to say. The documentation for kms:CallerAccount says that

The syntax for the Principal element does not provide a way to specify all identities in an AWS account.

However, I haven't been able to figure out what identities cannot be specified by the Principal constraint.