Many times the options may VEST over a 5 year period, but on something liek a change in control (buyout) the employees don't have to wait and all of their options become vested, so if you joined today and got a 1m share option package which vests 20% a year over 5 years and tomorow they get bought out - all 1m shares are yours the day the transaction is completed.
What you're describing is "single-trigger" acceleration but, at least for employees, "double-trigger" acceleration is much more common in stock option plans. In order to prevent the situation that you are describing from occurring, most agreements require a change of control plus a second event before vesting is accelerated (e.g., a merger plus the act of being fired by the acquiring company). That way management and employees have an incentive to stick around for a period of time post acquisition. Of course it's quite common for ceo's to have a separate management contract and single trigger acceleration is much more common in these agreements.