You're right, but honestly a lot of those enterprise rationalizations about their "sensitive" data are just defending headcounts and turf. Google and Amazon probably do a better job securing data than 90% of enterprise sysadmins.
I know that, and you know that, but do they? In my experience, no. And also, does the SEC know that? Possibly not. There's a lot of laws about this stuff where if you screw it up, people can go to actual prison.
