For ensuring legal compliance, there is a compliance department. Yes you obviously can't drive violating the traffic rules even if your boss asks you to. But regulations that apply to corporations, compliance etc are specialized laws, you don't have to know those. And it is the corporation that is acting. The individual employee who typed the Java API cloning thing in Orace v Google wasn't on the hook at any point.

Those laws generally aren't high crimes. You know when you're committing crimes against humanity.

Some people pretend they don't. And pretend they don't feel the judgement of those around them.

There is asshole and user-hostile design that doesn't quite rise to Nuremberg levels where "I was following orders" obviously didn't and doesn't work. But below a certain level it does work.