I like the metaphor of "bad apples vs bad barrels" But to me, that raises the question of how to tell the difference. Clearly, there can be individual instances of unique malfeasance in an organization. But I think it's mostly culture and expectations that allow for bad behavior.

Maybe the difference between bad apples and bad barrels is that the bad apples fear being found out by their organization. Average apples in a bad barrel believe that their actions are tacitly approved, even if the explicit "values" of the organization wouldn't allow them.