That's a fair perspective, but that's not applicable here. The punishment isn't because of how much she violated the policies, it's to send a message.

At Google, someone once disruptively modified the root permissions for the entire company-wide monorepo to show off that the permissions scheme was fallible. They were left off with a verbal warning, even though on paper they massively abused their position, and could have made the point without actually doing it.

The engineer in the OP took a much smaller action, that was closer to the scope of her actual duties, but was punished more severely.