You're a special kind of person if you are concerned about the privacy of your account and also enable your company's SSO on your account. I don't disagree that the conclusion of the story is that it sucks, but the moment you meld your private stuff with your company stuff you're asking for it.

I generally have little sympathy toward people expecting privacy on assets provided by the company, wether that be hardware or software. If you read your private email on a corporate asset, or enable sign-on with a corporate credential, all data can and should be inspected by your corporation. The fact that companies don't MitM _everything_ is what's surprising.