Many of those companies still have a few (not always skilled) IT people with access to everything! And they sometimes make it easy for themselves by putting themselves in 2FA exception groups etc.