There's network alerts of outgoing VPN connections to Russia, Tor usage, and usage of encrypted emails, none of which fall within work duties, accompanied by anti-West sentiment at the water cooler.

It could have been nothing. Which is why you investigate.

It wasn't nothing.

EDIT: You probably meant the code. Whoops. That's simple: Removing guardrails. Removing a null check, because it's "unnecessary" or "unreachable", etc. Opening memory holes, and burying that in larger commits.