Those conditions aren't realistic for an employee, since anyone working for someone else who feels that way is bound to be extremely frustrated. The point that

Those conditions aren't realistic for an employee, since anyone working for someone else who feels that way is bound to be extremely frustrated. The point that you missed, however, is that an employee should not accept the risk but should transfer the risk by notifying the employer. Otherwise, articles such as this are fodder for putting the blame of exploited vulnerabilities squarely on employees who knew of the risk and, according to some of the comments here, plotted not to tell their employers.