And it's the security teams job to assess the security needs of the business and apply policies. If the entire business has a data loss risk then sure a blanket

And it's the security teams job to assess the security needs of the business and apply policies. If the entire business has a data loss risk then sure a blanket ban makes sense. I disagree with what you said in that I believe "most businesses" need granular security policies that should be applied for specific departments. There maybe better ways of handling files but say you're a news corp and sources give you data over USB or a fashion company that has freelancers walk into your location's in person to hand in photoshoots and large cad files. The resteiction would have an impact both to users and to the business. For example,I worked at a company where specific departments were not restricted from accessing any website due to the possible business impact of them not being able to reach a required site.