You are certainly correct, but a bit of light digging + reflection on your company can give you a lot of confidence. For example, I work at a startup and I can say with great certainty that my boss has way too much going on for him to have installed any sort of rootkit after wiping the previous data and before I set up my admin account.