It's the same all over. Never speak up. Especially not internally. If you have to, find a regulatory agency that has the legal clout to protect you from retaliation, or go to the press anonymously. Know the names of the people who retaliate against you, and don't try to get them fired: it's better to know exactly where your enemies are going to be than having them vaguely at large.
Assuming that you trust that the regulatory agency does not have leakers back to the respective companies. When there's a revolving door between regulatory agencies and companies, it gets tricky.
That is good advice for regular civilian workers. But whistleblowers who have security clearances or are subject to the UCMJ may have to follow different disclosure procedures to avoid legal jeopardy that goes beyond regular retaliation.
You would have to be crazy not to be afraid of the "what-ifs". People who go up against powerful entities such as Boeing and the US government with credible evidence of serious crimes have a history of ending up dead, tortured, falsely imprisoned, or in the best case, living the rest of their lives in hiding.
It doesn't have to be that bad before people think it's too much. People get blackballed and never can get a proper job in the profession they're proficient in. That's often enough. Who in their 40s or 50s wants to start anew?
The charitable interpretation of for the reason why companies ask things to be reported internally is that espousing a stance where people have to report things externally could itself be treated as being equivalent to turning a blind eye to malpractices.
Legal stuff is weird like that; this is also why airlines will refuse to apologize for accidents, because such a statement could be equated to mean that only the airline was to blame for the accident without consideration of other factors that may have been out of their control, such as faulty designs on the part of the airplane manufacturer that would have been difficult to verify for the airline.
reply