This is why MFA is important and why it should be a separate device from the user's phone.

Why the hell was a personal device allowed to login to anything work related for a police officer.

Give them dedicated devices for it. Enforce MFA, and implement some basic MDR.

We implement conditional access policies blocking any access outside of company owned devices for a lot less sensitive data.

Seems to me if the government leaked people's financial data, each person should sue for $10 billion in damages and a $1.776 billion slush fund

Look at that! Yet another way that mass surveillance turns out to be a societal liability.