The comment is more about understanding that someone at your work /could/ do this, and there's relatively little guardrails or auditing to prevent it for many corporations. Moreso for those that actively monitor computers for files sent/received, etc