Depends on the data. If it includes potentially personally identifying information, it doesn’t get handed to devs for testing purposes, at least not in raw form. The potential GDPR penalties are astronomical.

It’s easy to generate fake data that approximates the characteristics of your real data set. You can also create a CI/CD test environment that allows developers to test against the database without taking possession of the database. Sure, a malicious developer could use such a system to exfiltrate the database by running malicious code, but that’s no different than allowing the same devs to push code to production machines