She apparently had access to employee data, not customer data. In my experience, businesses will often play a little fast-and-loose with employee data - far more so than customer data.

Though I agree it presents a bad image of GitHub's access control in general.