I agree with you that if the company did this to "get away with it" that it would be reprehensible. That said, by actually firing people it makes it hard for the company to do this again in the future, even if it wants to, because employees who remain are more careful about being compliant with activities.

In my experience watching company cultures, companies that fire employees for bad behavior (as opposed to reassigning or sending them for additional training) are less likely to be complicit in that behavior. And when this sort of behavior is uncovered at a higher level, more likely to fire the senior leader as well.

How do you know that they actually fired anyone?

It's irrelevant whether anyone was actually fired - there's now a news article saying that someone was fired over this, which is the same (if not wider reaching).

If they didn't actually fire anyone, you don't think word would get around a 625-person company that the PR statement that a rogue employee was fired was BS?