Fired is a bit much but I could see port scanning a prod server or like putting an interface in promiscuous mode generating a call from infosec asking for an explanation. Oh and the reply “I just wanted to see what happened” would not be a good one heh.