You're dropping context. Frances Haugen is being dubbed a "whistle-blower." The documents that she leaked have been damaging to the company. In addition to tha

You're dropping context. Frances Haugen is being dubbed a "whistle-blower." The documents that she leaked have been damaging to the company. In addition to that, she said that she was expecting IT to flag her account activity and ask her what she was doing, but it never happened. So Frances herself described the access control policies as lax. Security begins with risk assessment. You identify your assets and how they may be vulnerable. You then model your security protocols in accordance. In my experience, this is almost never done. The typical approach to security is reactive, not proactive. And when proactive approaches are done, it is usually done with an eye towards covering the company's ass rather than giving the slightest concern to the interests of their users. That's how I arrive at my conclusion. If Facebook takes such a lax approach to their own internal security that means they likely have a perimeter approach to security, rather than a layered one. They may try to block attacks coming from without but have little measures in place with regards to segregating, isolating and restricting once within. All of this is speculative of course. Facebook might be the one single example of a company that actually takes some serious measures to protect their users' data while not being as concerned with their own internal data. I suppose such a unicorn is plausible. I just don't consider it very likely. I've never seen it happen once in my 25 years of industry experience.