I'm finding out in another parallel thread[1] that you might be right and I might just coincidentally have worked for the few companies that take data protection seriously. I don't think I've worked anywhere since 2009 where rank and file engineers could just go access prod customer data whenever they felt like it, so I started believing that that is outlier behavior done by a few companies with cultures of carelessness like Meta.

It just seems so implausible. As soon as a company is big enough to hire their first General Legal counsel, you'd think that kind of practice would be flagged as highly legally risky and stopped. I'm reminded of the gcreep[2] incident which happened over 15 years ago. What company wants to go in front of a judge and say their policies allowed something like this?

1: https://news.ycombinator.com/item?id=50179136

2: https://www.gawkerarchives.com/5637234/gcreep-google-enginee...