This is basically the same as hiring a new person and giving them normal network access to get their job done. Did they upload a file to Beijing? Who knows?

There are whole branches of data security, practices, and products dedicated to answering that question and managing that risk.

The similarities look obvious, but how are these situations different? Seems like an interesting question.

So why are we doing this, if it is not better?