Assuming your developers have malicious intent is a bit strange for me personally. But I get that some companies may have this structure in place.