> It wouldn't prevent malicious code going out but at least would require a chain of cooperation between employees, which would be harder to achieve.

No, it just requires a chain of cooperation between authorized accounts. That's a very important distinction, especially here, where the email in question alleged the following:

This included making direct code changes to the Tesla Manufacturing Operating System under false usernames