Correct. Companies are not monolithic. How many people do you need to know about it, in order to hide something from the monitoring systems and management alike? 10? 2?
That's not quite a 'black bag' job. Nor is it completely legitimate. It's something in-between, which most of the time lets everyone work under convenient fictions, getting on with the rest of their jobs.
But to consider another variant, I could absolutely see a janitor becoming convinced by men with badges that he must cooperate with their investigation, perhaps by planting a bug or offering out-of-hours access. A janitor could also be convinced by official-looking (and perhaps even truly official!) judicial paperwork that says he's not allowed to tell others.
In the case of my hypothetical 'Joe with Ft. Meade experience', the cooperation is cheerful because he believes in the mission and legitimacy of the request. But under the strange logic of compelled secret compliance, lower-level employees might be coerced into cooperation. (That'd be more likely to be seen as a true corporate infosec failure, rather than a "wink, wink, 'failure'", from the perspective of top executives.)