I think they read sections of docs on process_auditing and eventing framework and some of the 'warnings' might have scared em 🙄