Incorrect. In banking you have:
Public
Internal
Confidential
PCI (Sometimes called Client Confidential)
Which is pretty universal across the banking world.
Customer information is a completely separate status compared to Confidential. In addition there is a 5th status, rarely used, Trade Secret classification.
PCI data is 'need to know' access, usually through a tool called RACF. Very few people have full access to PCI data in banking. Even branch staff are looking at the data via an interface and only see a portion of the data that matches their RACF profile.
DDA and TDA info is separate from Plastic Card data, package codes, transaction (General Ledger) data, etc. All those different data sources are built into views\screen that are controlled by entitlements per user and role (templates). I deal with it daily as I have, based on my role, full view access, but 99% of staff cannot see all the data at once. Collectively it is called 'Separation of Duties" policy.
In banking a single customer's data is actually a collection of 30+ databases woven together. In general and simple terms you have:
* Customer
* DDA
* TDA
* General Ledger
* Automatic Clearing House (ACH usually)
* Packages (Things that apply to accounts, for example A Gold Card versus Platinum Card, Regular Interest, etc. Think of them as video game buffs and curses to products)
* Mortgage
* Wealth Management (Trust funds for example)
* Tax Processing (sometimes called The Year End System)
Each of those could have dozens of databases and each of them could have 1-50 sub-databases all woven together through a security management suite (RACF is an example) and every one of them has their own security requirements and entitlements. At any given bank there is likely less than 20 people that have full access to all of those systems to view that data. On planet Earth there is likely less than 20000 people that have full access to view all that data at once across every single banking institution.
Likely they were storing PDFs for mortgage documents on a network share rather than in a secure document management system or something simple like on-prem Sharepoint, which is fine if they are encrypted. PCI requirements don't cover malicious authorized users from doing dumb shit like deleting files.
That said if the Credit Union was giving blanket full access to all employees, right now, the deleted files and the rogue employee are seriously, the least of their concerns. Visa could drop them for non-compliance of the PCI standards (which Visa pretty much created, many places still call it Visa Compliance versus just PCI) The fines are multi-multi-millions of dollars.