I mean... Deloitte is mercenary, and hired by the company wanting a passed audit.

They get paid to check pre-agreed spots A, B, and C and keep their eyes closed outside those areas.

A RAM-only server can still send metrics, metadata, "anonymized" metadata...