I dunno, man. I’ve been doing cybersecurity for two decades and there are an awful lot of really stupid / ignorant / blissfully unaware people in IT across the private sector - particularly at big and older companies. It wouldn’t surprise me in the slightest to learn that something like this goes unnoticed. Unless you suspect a problem, if the system isn’t subject to regular audit, it could go on for years without anyone bothering to check.