Yeah i write financial software now and we're PCI compliant. Devs can't access prod or its very limited and read only with no access to encryption keys. Those who do have prod access, don't have write access to the code. No one has both.

All software installs on any company device are reported to ops.

I'm not saying this couldn't happen but i think it would be way more difficult. Also, we're a company of 15 people.