If Microsoft implemented proper security policies, I imagine that guy didn't have access to all of Microsoft's user data.

So that would be the main difference. Virtually all of a company's employees shouldn't have access to user data at all, and those that do would only have access to parts of it.

>If Microsoft implemented proper security policies, I imagine that guy didn't have access to all of Microsoft's user data.

This is precisely the sort of thing Microsoft takes incredibly seriously internally. Tim Cook may be a more vocal spokesman for treating user data with care but Microsoft is fanatical about it internally. They recognize the risk they face in the event of compromise and have made just enough mistakes in the past to appreciate how hard it is to actually protect their customers’ information.

This might be a naive view, but I think companies that are good at this sort of segmentation will also be good at picking trustworthy third parties and limiting (both technically and legally) what they can do, and conversely, that companies that just send a bunch of sensitive data to third parties out of laziness have no meaningful internal controls either.

"Avoid third parties" is an occasional effect of conscientious care of data, not a cause of it.

What?

How about "lets just not spend medically sensitive information to third party services"

That seems reasonable, but can we also say, let's not send medically sensiive information to every employee at the first party?

You could not fill out that part of the profile.