I have seen agencies store sensitive data in SQL express on a local 'client' as a way to cache slow operations.

I have seen otherwise intelligent developers shrug and say "meh, that's what they wanted".

I have left those positions.