I don't disagree on a conceptual level, but on a regular basis I deal with companies completely lacking any real access model, users without MFA, blanket admin

I don't disagree on a conceptual level, but on a regular basis I deal with companies completely lacking any real access model, users without MFA, blanket admin level access, etc... getting sold on this particular product and something spending 7 figures to adopt it.