Yes, poor judgement. I also think it's sort of dumb to steal self driving "tech" from Apple. Might as well steal Uber's self driving "tech" as well.

I’m sort of surprised they don’t have automated flagging for activity like downloading a years worth of documents in an evening.

Benign instances of that happen all the time. Picking out actionable anomalies from event data like this is one of the big problems in information security.

They do, according to the article:

“Apple grew more suspicious after seeing his increased network activity and visits to the office before he resigned, according to the complaint.”