It's a pre prepared tool. So the effort required comes down to "not a lot".
Perhaps Microsoft would let them all join "teams" for free??
"Here, she misused a security and privacy tool to create a pop-up that was neither about security nor privacy," the letter says. "She did that without authorization from her team or the Security and Privacy Policy Notifier team, and without a business justification. And she used an emergency rapid push to do it."