But I don't think glossing "the change went through code review" as "She did it exactly according to internal policy" is helpful.

In this case I suspect the reviewers were supportive of the protest, and so approved it even though their authority didn't cover this kind of change.

I don't think any of these people should have been fired, but "by the book" is not a good way of characterizing this process. That would have been proposing the feature to management, getting their sign-off, and then making the code changes.

That sounds about right. So why doesn't Google fire the reviewers? If they don't, then they are inconsistently applying the standard. If they do, then they are punishing a coordinated employee action.

Let's take for instance the fictional case of adding a list of website to a whitelist.txt. Maybe the source file had thousands of websites to be added. Anyone could add or remove some in the middle and no one would ever know

It looks good when you review it. but there is no way to check the data integrity (at review time), you can only rely on the good faith of your coworkers.

I am not saying that's what happened but this is a good example of how anyone could sneak-in arbitrary code that pass the code review.

Is the literal problem, which necessitated the pop-up.

The Organization Does Not Approve™

It’s like asking someone if you can kick them in the knee before doing so. What do you think they’ll say?

Y’all seem confused: the organization, Google in this case, is antognizing it’s organizing employees. Google absolutely do not, will not, can not approve of unionization efforts. Ever.