When I was at Facebook (2018-2020) there were in fact few permission barriers (click through the screen warning you to follow the rules, and that's at the UI level not to mention pulling stuff directly from Tao through the old PHP interfaces still laying around, or just building a user context from scratch), but plenty of auditing and automated detection.
I always did wonder how good the detection systems would be at catching people who access private data directly from Tao.
I've heard stories of same day firings, but never saw it myself. Maybe it was a myth put forth to dissuade the curious.
I have had friends who worked at Facebook brag about how easy it is for them to read anyone's messenger chat.