This one definitely drives me nuts, but these days I don’t see how else to keep systems safe. It would be nice and probably be pretty effective if you could just prove to your IT team that you’re not a moron to get reduced restrictions though. Most people I imagine would fail or not even make the effort, so you could be reasonably sure the risk was minimized this way.