> searched for and installed specialized software onto his company-issued laptop

That could mean he downloaded an SFTP client like Cyberduck. He could have searched the internet for a client and then installed it. It doesn't say he did not have auth.

Imagine a Google security engineer being deposed for this lawsuit.

Lawyer: "Show me on the MacBook how he downloaded the files"

Engineer: "Well, he used Cyberduck"

Lawyer: "Is that part of the Mac?"

Engineer: "No, he'd have to download it separately"

Lawyer: "So, he searched for and installed specialized software onto his company-issued laptop?"

Engineer: "Um, sure"

Lawyer: "Thank you, that's all the questions I had"