For quite a long time (and probably still today but I have no idea) there was at least as much monitoring and security infrastructure built around watching and auditing what Facebook employees did to data as there was around what third-parties might be trying to do to Facebook infra and corp networks.