I dont think any of that is inherent to cybersecurity, just lots of cybersecurity teams are dysfunctional in their org which leads to bad outcomes like pointles

I dont think any of that is inherent to cybersecurity, just lots of cybersecurity teams are dysfunctional in their org which leads to bad outcomes like pointless requirements. In fairness, lots of the quackery cargo cult stuff often comes from outside the security team, and security is just tasked with enforcing it (e.g. it comes from contractual requirements with customers or other compliance stuff)