Ideally, but until someone asks for it the first time, they probably don't even have an account for the purpose. So, an irritated DBA who has myriad other backlog tasks probably runs it on a copy if smart, and production if lazy or in a hurry. Would not surprise me in the slightest if an important table was dropped in this way.

Yes, but if they're not sanitizing inputs, they might not have set permissions wisely either.