Yep. I've worked in on a multi-tenant product in which I've seen senior engineers write APIs that would have allowed one tenant (enterprise customer) to access the data of another tenant!! Insane.