Their VMs are often used for cloud gaming. Your own version of GeForce now essentially. The attacker might have told the employee to check if it works or something of the sort.

So it’s not too far fetched.