I have policies at my workplace that disallow something because it's impractical to judge every single situation and then have to deal with the gray area.
At Google, someone once disruptively modified the root permissions for the entire company-wide monorepo to show off that the permissions scheme was fallible. They were left off with a verbal warning, even though on paper they massively abused their position, and could have made the point without actually doing it.
The engineer in the OP took a much smaller action, that was closer to the scope of her actual duties, but was punished more severely.
It's exactly applicable. If you violate say, finance reporting laws (KYC) then you've violated finance reporting laws. If you've added unauthorized code to an internal tool, well, you've added unauthorized code to an internal tool.
And had it been part of a security disclosure, well, that might be different (did they try other disclosure avenues?), but pushing a political viewpoint isn't. Imagine instead if the employee had added the message "Trump 2020" - how would you feel about that?