I agree it reflects poorly on the organization, but the previous story on HN [1] mentioned that the malicious insider had scared the CEO into giving access by manufacturing some sort of security incident. Had this not happened, he would not have been able to pull it off IIRC.

That would also point to the CEO being too powerful when it comes to security, which is also a knock against the organization, but in a different way.

[1] https://news.ycombinator.com/item?id=29411775