This just isn’t true. They _should_ have top notch security but that also requires responsible, security-aware action from the principal.

This assumption was destroyed during the first Trump administration and continued being eroded in his second. They do not practice good opsec. (See Signal app usage) Nobody is enforcing policies, and nobody tells the bosses that they can’t do something because [reason].