I've experienced this first hand as a developer. Our team was working on revamping an e-commerce platform and we had developed a CRUD API for the shopping cart.

I've experienced this first hand as a developer. Our team was working on revamping an e-commerce platform and we had developed a CRUD API for the shopping cart. Everything was going smoothly until a manager decided to take issue with our use of HTTP DELETE for removing items from the cart. The person in question wasn't technical but pointed to a document which expressly prohibited the use of the DELETE verb across all applications developed by the company citing an unspecified security risk. Wasn't around long enough to dig deeper into that, but probably wouldn't have gotten far given how partial the company was to superstition.