OK, maybe I'll concede the point on legal oversight. But I'd at least expect an engineer to be familiar enough with where the law intersects their work to push back on things obviously illegal.
Ethical issues are more likely to be encountered. And they don't even have to be "crimes against humanity" level. I'd expect a professional engineer to strongly push back on and/or refuse things like "write code to cheat a benchmark and make our product look better than it is" and "implement a dark pattern to trick the user into giving us personal information" and "increase our signup funnel by harvesting our users' address books and spamming our app to their contacts."