> I kind of assume that they're competent
"Never attribute to malice that which is adequately explained by stupidity."
"Never attribute to malice that which is adequately explained by stupidity."
I assume them to be broadly technically competent in so much as they won't let their master install get infected with a key logger.
I'm happy to accept that they may be incompetent when it comes to making decisions about whether it would be a good idea to install a key logger for support or audit purposes.