It’s less a case of worrying about maliciousness than incompetence. I remember reading a post here about some junior dev who accidentally dropped a production database. I can see an employee accidentally doing a DELETE/FORCE [...]*.*;*¹ in the wrong directory.

⸻

1. The VMS equivalent, to the best of my recollection, of rm -rf *