How much damage could a bad internal actor at Coinbase cause?

I'm trying to work out how much risk I'm willing to accept by using Coinbase. If one of their programmers intentionally wanted to become a bad actor (say for example they catch wind that they are going to be fired), could a Coinbase developer easily cause billions of dollars in damage by somehow transferring coins out of the client accounts?