This is true, but most institutions like Coinbase don’t have customers email employees.

Customers email something like “[email protected]” and that routes to a ticketing system (eg Zendesk), not to people.

And, the vast majority of employees don’t directly interact with customers either.

Well designed controls deliberately keep PII data out of general purpose systems like email, drive sharing, dev ticketing, etc

I agree that the remote move introduces new risks, but those should be minimized by the existing controls in place.