If I had to guess they probably use stock OS for most employees and defer to network-level filtering beyond that. Not because their stock OS behavior is wildly secure or anything, but because they’re notoriously secretive and have other reasons to have very tight restrictions on external network access.