Yup, this. Cover your ass by putting shit in writing via email, (and bcc your personal email too, so they can’t just delete the emails off the mail server and pretend they never existed.) But besides that, if the boss wants to have a vulnerable system, then that’s their prerogative.