Once a company reaches a certain size and deals with sensitive enough data, it's poor risk management practice to leave device security entirely up to the indiv

Once a company reaches a certain size and deals with sensitive enough data, it's poor risk management practice to leave device security entirely up to the individual. Mistakes are made, malware-laden software is downloaded, laptops are lost in town or borrowed by kids or S.O.'s at home, etc. Restricting the user's device permissions is not a judgment cast on any individual specifically, it's just a responsible way to deal with something that statistically happens sooner or later even with perfectly well-intentioned employees.