Aware and signed off on the project and aware and signed off on the defcon presentation are two different things. I only know what I've read in this article and discussion on this, but I don't read "Salesforce executives were first made aware of the project in a February meeting" as meaning they had corporate sign off (they may have, but thats not what that sentence means)