Oh yes I work for one of those sorts of companies. Right on.LOL oh so it's the regulations now! This is typical IT being completely out of touch. Productive companies find a way to enable their employees by understanding what business needs they have and designing processes around that. Garbage ones just dictate poorly thought out lock down systems, mumble something about compliance or best practices, and just convince themselves that whatever business needs they are sacrificing couldn't have been that important. Worse yet, they often have a special approval process to get around the lock downs in a tacit admission that their policies are in fact hindering the business. I've worked at 5 companies. There is a direct correlation to home much freedom the user has on the PC and how much work gets done by each person. Maybe the benefit of highly locked down systems is higher than the benefit of productivity. It depends on a lot of things about the business. But, most of the time, that question is simply left unasked. AND, that's why it's out of touch.
The thing is the key perspective these days is trading off the trifecta of compliance box ticking, hiring minimally competent staff and trying to patch all the holes with dubious technology sold by incompetent enterprise companies.
I am pointing fingers at the following things for being absolutely inconsequential for organisational security: ISO27001, SOC2, CloudStrike, every AV company on the planet, InTune, NCSC policy.
Source: day job is engineering management at a major fintech. It KILLS MY SOUL seeing confidence and security built on these wobbly sticks made of poo.