IMO it's concerning that they don't have more granular security controls than totally shutting down someone's access (or maybe they do, but they laid off the person who knows how to take access away from production systems without taking away someone's ability to read email)