That is how most business owners find out their systems have been compromised. Not because money went missing, not because files were encrypted, but because someone who trusted them called to ask what was going on.
The more interesting problem is what the machine holds. Every person who has ever logged into a system from that computer and clicked “remember me” has left a credential sitting in the browser.
The number one cause of mystery software is the installer you didn’t read all the way through.
Data breach notification laws do not distinguish between a hacker accessing your systems remotely and a person physically walking out with a device that holds the same data.