If she hadn't done it on her work laptop, her personal would have been pwned anyway. It's not clear to me how to protect oneself while also looking for work.

…what? That’s not how this works. You don’t get to misuse company resources for the purpose of transferring the risks associated with your personal activities from yourself to your employer.