This is the magic of "corporate compliance". A corporate organization can only add more forms, checks, policies. They can have both a big fire drill for a thing

This is the magic of "corporate compliance". A corporate organization can only add more forms, checks, policies. They can have both a big fire drill for a thing that was left in a conf room one time, as well as leak huge amounts of sensitive data through routine operations. They can strictly require X, Y, and Z, while Z is not really necessary and X is really important to make sure it's done right. Later they'll add Xv2 and Xv3 signed in triplicate to ensure X is done right, but still won't really ensure that X is done right. That's just not what a bureaucracy is able to do. They can't just fire everyone and then re-hire only people who care enough about doing things right, that's impractical. So they can add more forms, policies, fire-drills ... Side note, most people don't care about the "EULA" or "privacy policy" on everything, it's just for "compliance", 99.9% of people never read them, no one expects you to read them, you just sign, that's just how everything works. Yeah it's dumb. But you can see why pretty much all practical every-day people ignore the implications.