In most small to medium sized businesses and startups the developers and IT admins have access to absolutely everything!! Developers can see things and run reports that even the CEO cannot see. IT staff often have access to all the passwords and data of all of the users too. I'm certainly not saying its 'right', just this lack of security from internal staff is more the rule than the exception.