He told me that we have a real-time backup system so he didn't think it was worth fixing. I then asked if we ever ran tests of that system and if we had documentation on how to restore from it. We don't. This is for financial trading application handling billions of dollars. Being down for even a few hours could be catastrophic.
The big man spoke. I don't agree with the outcome, but I'm not the boss. So that was the end of it (except for in discussions like this on here). I left for another team because there's no way I'm going to be the security champion for a system with that level of risk. And thank God you weren't my manager or I would have been fired under your #2 scenario.
On a side note, just because a small number of people are complaining doesn't mean their opinions are invalid. Minorities are often disenfranchised due to this thinking. Also, managers may not know all the policies for the company and may be violating them.
For a real life example combining these, company policy states that a person be evaluated against the standard and recieve a rating that way. Some departments mandate that if a manager pick a higher than average rating for someone, then they must pick someone else to balance it out with a lower rating. This would only affect 10% of the population and the number unjustly affected would be lower than that. So the other 90% recieved good rating, so why would they complain? The objective way I know that I was unjustly rated was because I had a manager friend who told me what happened in the meeting and said it was wrong.
#2 seemed more fitting since no action was taken. And it resulted in me leaving that area of the company (voluntarily thankfully).
I'm mostly playing devils' advocate here, as newspapers, lawyers and shortsellers usually have their own axe to grind and are continually searching for good David against Goliath stories.
Just dropping in that having a toxic effect on the company and being respected / appreciated by peers are absolutely not mutually exclusive. Often times they rather go hand in hand and you've got such people rallying up others over non-issues (in the big picture of things). As others already said in the comments, cohesion and alignment are far more important to a high risk / high growth company than "solving all the problems".
Case 1: An actual smart and caring employee bypasses the chain to give me evidence of a manager not acting in the companys interest. Usually that's not the first indication of such a thing and listening around reaffirms the conclusion quickly. The manager is approached as quickly as possible and since at this paygrade it's in no-one's best interest to burn bridges, they suddenly decide to spend more time with their family, a sweet severance package changes hands, employees are happy again and you don't read about this in the news. It's exactly why I said this in the first place (and meant it).
Case 2: An employee with issues not bringing the company further (usually one or more of paranoia, toxicity, not-seeing-the-big-picture, searching for problems instead of solutions or emotional health issues) bypasses the chain of command with "evidence", but listening around almost nobody shares this employees' opinion. You fire them. Suddenly all problems disappear, employees are happy and then you read about this in the news, because the only person left unhappy did really not get the memo.
Judging from the type of problems here (something something starship about floor mats at a time when Model 3 just wasn't ramping up production and cashflow almost ruined the company), I do have my opinion about the type of "privilege escalation" in this case but I obviously won't share it.