> Imagine someone works for an organization, and 'the rules and constraints' require them to murder (without legal consequence) innocent people on a regular basis;

Several large corporations really are guilty of murdering innocent people on a regular basis. Even still, if you find a low wage worker in that company's mail room and beat the shit out of them to make yourself feel better it's you who are the asshole, and it does nothing to stop the killing.

This isn't a hypothetical, you're just describing social murder. What do people do about it? Usually shower the perpetrators with money and peace prizes.

Following your organization's data security practices is not immoral. To me, refusing to accept a PDF is no different than running a cash only store and refusing to accept credit cards as payment.

That is war.