While you're broadly right about the legal authority, keep in mind that the founders can't do most things themselves and at a large corporation, can't even monitor most of what's going on themselves. Getting a large bureaucracy to do something complicated is not as easy as sending out an email. (The most obvious case of this is stopping leaks, which is not as easy as the CEO saying "don't leak stuff".) They can set OKR's but whether they get done or not isn't guaranteed.
Matt Levine occasionally writes about amusing corner cases where corporate governance gets metaphysical [1].
I would guess that Google and Facebook might not have turned out quite like the founders had hoped, though of course they have more power than anyone to turn things around.
[1] https://www.bloomberg.com/opinion/articles/2018-05-24/compan...