There are reasons beyond compromised machines. Some companies have compliance/insurance concerns that require things to be set up a certain way, and to prevent

There are reasons beyond compromised machines. Some companies have compliance/insurance concerns that require things to be set up a certain way, and to prevent users from undoing them. E.g. full disk encryption might be required, and users prevented from undoing that. Maybe there's some kind of audit agent that needs to run, and you don't want users removing it. Others don't want engineers breaking their desktops, or setting things up in a way where it's going to break the automation. E.g. systemd-networkd is centrally managed, but some user hates it so they're using network-manager instead, and now they can't connect to the network because network port control got turned on. Amortize that across several thousand engineers and you can waste a lot of man-hours because people aren't using the tools they're supposed to. I like having full root/admin permissions, but I don't really need or want 95% of the permissions it gives me. Linux makes it hard to delegate the 5% I actually want/need without giving me the other 95% that are basically only ever going to be problematic.