Nobody seems to mention an important aspect: megacorps like Microsoft, Amazon, Google or Oracle hire thousands of engineers each year. It's not particularly hard for a bad actor to get an agent hired into their target and gain access, for nefarious purposes, in the legit way.