Maybe that was still required with the vpn, access vpn can also mean compromise a device, they only said yes to an attack chain someone was asking them about in the screenshot. I agree with you to the most part but at the time of posting the discussion was entirely around initial access and mfa which is not inline with how security is done these days.

I'm curious what your take is on the incident detection side of things. Would Grapl have helped Uber detect anomalies?

It is irrelevant though. If your whole multi-billion company folds like a wet towel when one user is compromised, the question isn't how that user is going to get pwned, it's when.

Relevant xkcd: https://xkcd.com/538/

If you really really want one user to control everything, maybe they should work on a desktop station with a guard at the door.