I don’t think you can infer that, and they already said they don’t believe any data was stolen, I’m sure they did extensive audits on his network history already.
Depend on policy, you could copy the file to ext storage.
This would be even more easily detected, and you couldn’t do this on many corporate laptops in tech anyway esp if they have something like CrowdStrike running.