That's a also metric I use when I choose service providers. If every employee is allowed to abuse any other employee's credentials to access my private data, move on.