It's because security, audit, and ethics teams aren't judged by how much they enable others, they're judged by how many threats they block. I work at a well-kno

It's because security, audit, and ethics teams aren't judged by how much they enable others, they're judged by how many threats they block. I work at a well-known tech company but joined when they were still very small. Our original security "team", a team of 2 engineers, were highly plugged into the product and the concerns of the then-small engineering team. This team was always willing to help and enable builders to stay security conscious. As we grew into a large company and our security team became an entire organization at the company, the org lost all connection with the product and became a more classic blocker-based team. The org lost empathy with the product and was judged on no product metrics, so naturally the culture in the org began to just be saying "no" to engineers all the time. A few of the earlier hires still try to help, but for the most part they just block.