I very much doubt it was a PM in charge of reading the TOS for the enterprise certificate program. When you need to sign a contract on behalf of your (multinational, FAANG) company, you get your legal team to go over it.

The legal team would have reviewed the TOS but they probably weren’t looped in when some PM got the idea to use the certificate for this purpose.

In my own experience people often avoid consulting legal when they think they can get away with it (or don’t realize they need to), although I’m sure it varies a LOT based on company culture.

What? Almost any apple developer in google could sign their app with that cert, and send it to anyone that has accepted the cert.

It's better to ask forgiveness than to ask permission.

And, on top of that, Facebook and Google have retaliatory power, so they know that Apple's response will be measured in a way that it wouldn't be with smaller developers.

Google certainly has a history of doing stuff like this:

https://www.bbc.com/news/technology-17076670

Given the common appraisal of the competence of both Facebook and Google, it is difficult to believe they just didn't understand things.

Someone decided (probably correctly) that the benefits of the app while it was distributed were greater than the potential penalties that would come way down the line.