Ehh. Depending on the industry and issue, thats wholley justified, not only from a "least privilege" sense, but from a regulatory one.
Step over into cybersecurity and you end up spending all day clamping down on usability because the company has legal requirements to meet to continue to exist. Many of the things we are compelled to do are overeager and overly pedantic, but it's either "do it, pay up, or shut down." The execs tend to prefer "do it" in my experience, which makes everyone's day a bit more tiresome.
So its entirely possible that was out of their hands.