Sure, but the reason isn’t always just security.

We have government contracts and want more. But to get those, they insist on us doing a bunch of security things.

So it sucks for the users, but if we don’t implement the restrictions, we lose the contracts and thus the income.

And as a side benefit, holy shit we are pretty secure. Next annual pentest soon and I’m expecting good things from it!