Yes, and what about the possibility that an attacker already accessed this database and added themself as an employee?

Would you rather to be prepared and do a full (well, for a govt agency, full enough) check on all people allowed to access flying death machines, or have a dev silently fix the issue with possible issues later?