Much of the talk on this is about wether it not SFDC has a ‘right’ to do this, or if it’s legal. Frankly that’s all immaterial - this sounds like a perfect way to either lose most of your security staff over the next 6-8 months, or get yourself fired. Not sure the exec in question was planning on either of those outcomes, but they are the most likely.