I'd give good odds it was a mistake by a staff member (or small group) who overstepped and was not part of any formal work. Most companies where I've worked as

I'd give good odds it was a mistake by a staff member (or small group) who overstepped and was not part of any formal work. Most companies where I've worked as a security researcher, you get some time as part of your job to hack on random stuff to be able to generate interesting talks / research. This feels like that. This isn't a special cyber spooky practice, most pentesting companies do this to generate IP (rarely, lol), buzz (reasonably often) and keep the staff happy (this is really the main thing). It's rare for management to be fully across the scope of this.