Some good points, but I'm worried engineers take this as advice to always test with real customer data and even connect to prod from their dev boxes and such. Not a good way to handle PII.