Yes but doesn’t change the issue. That scenario will happen and no CTO on his right mind would allow indiscriminate and random tool usage as it opens the company to a ton of possible liability. If someone does then that person is just bad at their job.
usage was officially sanctioned
What do you mean by this? Is there an entire set of guidelines and security policies for both Windows, macOS and Linux users on the company? Like AV software they’re required to run, do they lock Linux machines with policies like they do with Windows ones? How does it work? If they don’t to any of the above then we’re back to my previous asessement.