They probably have a humungous firewall and several dozen antiviruses on computers that are reduced to a crawl.. what can an attacker do in that scenario?

In my office, most users can only access 2 or 3 webpages anyway. When I did development for a financial company, I had a separate computer for internet access, on a separate network (shared by several devs).