Who's saying they weren't? I'm sure that administrator would have been able to plant subtle backdoors, or find and not fix vulnerabilities and misconfigurations, during their time there. In which case it wouldn't matter that their credentials were revoked.
Honest question: Are Ansible + peer reviews enough to secure sysadmin work? Of course they can log on the machine to open a backdoor, but they are supposed to be regularly destroyed and rebuilt regularly, so we're theoretically safe, aren't we?
