Yes, this is precisely the problem.

Does this sometimes lead to "we are immortals, can do whatever we want"?

Actually not whatever. But apparently some borders are quite thin.

Shame

I have never just deleted millions of emails and pieces of evidence in a listed company, especially one that falls under the SOX act (it implies some governance.)

Did they have the IT governance or not ?