What I really don't understand is why the security people who sent to jail didn't drop their boss in it in return for diminishing their role
Cush consulting jobs after the fact. You don’t burn your social network unless the alternate is serious jail time. Given the slaps on the wrists described, clearly the after conviction pay day is more valuable.
Possibly because they hope for gainful employment in future, and being a whistleblower of any variety tends to massively reduce the chances of that.
There is a chance there wasn’t anything incriminating. The top guys kept conversations live or intimated they wanted something done; the lowers took the planning and execution upon themselves.