Yes. The situation improves considerably if, when making server changes or retrieving data, programmers are required to enter a code generated from a hardware TOTP token isolated from both PCs and smartphones.

Every service provider system should be designed with the assumption that programmers' PCs and smartphones may be compromised.