The Gitlab production data deletion event occurred unintentionally because the system was not designed to make it impossible. Looking at the Kaspersky situation the same way, the leaking of classified documents to Russia occurred because the system was not designed to make it impossible (i.e. by never creating these materials in the first place). GP isn't equating the facts of the events but instead drawing a contrast between the way we treat them.

Drawing that comparison is asinine though.

We treat nude photos differently than photos of a dog.

We treat credit card/user information differently than app logs.

That's why we have concepts such as HIPAA and PCI.

The point is punishing a person (often near at the bottom of the totem pole) does not fix the systemic problem. In fact, it creates noise which distracts us from fixing the problem. The first step toward fixing a problem is acknowledging there is a problem and identifying the problem.

I am very saddened by my inability to communicate this in a better way but punishing this person will not solve any problem except someone somewhere can check a box saying they did their job.