Point is that Automattic would have full access to this as well.
Attempts to go fishing in such records would be pretty unlikely to succeed; it'd be an uneforcable request contrary to public policy, with no relevance to such an audit. It would be correctly and easily fought.
Point is that Automattic would have full access to this as well.