detected unauthorized access to an internal support application using a password that was shared with a compromised personal account
Someone's updating their resume tonight.
Someone's updating their resume tonight.
Of course, if they do, then firing might be the way to go. First time mistake, second time incompetence.
"Employees may not use passwords that are used with any service outside of the company."
Zero enforceability (but some companies would probably ask for a list of outside passwords I'm sure), but in the face of a direct policy violation, 100% fireable, and can help a company in terms of liability.
In general though, in any security breach the most common way to pivot is via password re-use. You'll see this happen with many privileged employees at almost every company.
At a start-up, it most likely was not an engineering decision, but an agility trade-off. Get that product out the door now!