I hate to break this to you, but engineers themselves are capable of running arbitrary malicious code on their own workstations, even if we ignore the dozen oth

I hate to break this to you, but engineers themselves are capable of running arbitrary malicious code on their own workstations, even if we ignore the dozen other ways it might get there (dependency attacks, social engineering, browser exploits, plugging in a USB key you found on the ground, etc.). At Google’s scale you need to assume that even some employees will be bad faith actors (e.g. agents of some government, with a goal of surreptitiously adding back doors) and you need far more sophisticated security controls (e.g. multi-party controls, immutable audit trails) than assuming engineers or their systems will never be compromised. The latter is going to be true for some employee nearly 100% of the time even if you don’t have bad actors. The existence of these controls and general set of security assumptions and architecture are what make this not a big deal, not a lack of care.