1000 people absolutely is limited - it's not everyone at the company! I'm sure they did their annual security training, like everyone here, and they might have even passed an additional screening and another training session for account access.

You have unreasonable expectations for what "limited group of trained and vetted employees" means in a CSR environment for millions of customers.