At any large employer you sign an agreement to follow the employee handbook and internal policies. They all say the same thing: don't violate the policies even if directed to by your manager.

In this case Apple's legal department had identified the serials and IMEIs as PII.

This is why the case is in civil court and not criminal (because Apple didn't violate any "laws" as you claim). It is a contract dispute.

The employee didn’t have a contract with Apple so it isn’t a contract dispute. These would be statutory causes of action (also civil, but different than contract law) based on the claims in the suit. The plaintiff alleges Apple broke the law, but specifically whistleblower retaliation and disability discrimination statutes, not consumer privacy laws (which is sort of a secondary concern to the whistleblower claim, since those protections can apply even if no law was actually broken).

Boardman notified Apple’s legal team. At that point it was their decision to make. If they had told him to stop, that’d be one thing. But they didn’t, and it wasn’t up to Boardman to interpret the policy differently.