This isn't the case. There's a toggle on https://admin.mistral.ai that allows you to disable training for both Vibe and Console/API for your entire organization, I just checked.

Yes. If the privacy control only exists per user, it isn't a control for a team.

Defaults matter more than the blog post. "You can opt out" is not the same product as "the org can actually enforce opt out."