It depends on what kind of evil.

There are evil things that only CEO’s or sales can do, like unfair competition. Then both the dev and the maintenance guy are not guilty.

But if it’s done by software, then the dev might be guilty, depending on his personal part of it.

If a company is doing all kinds of evil and everybody knows it, then both are to blame.