I never cease to be amazed by how many people think MMs can just do whatever they want, and no one will ever know.
As you say, they have their own compliance people to worry about, and then their auditors, and then FINRA, and then the SEC.
Sure, people screw up, and they're fined by FINRA. Usually the firm is fined as well, for "lack of supervision". But most of the time, the mistakes made were just... mistakes.