The problem is you can't simultaneously say "secure things via network access" AND "ensure everything has strong auth" -- invariably that collapses to the easie

The problem is you can't simultaneously say "secure things via network access" AND "ensure everything has strong auth" -- invariably that collapses to the easier/cheaper of the two. So the superior realpolitik approach is to mandate the latter and remain silent about the former. Best case, they'll do both. Worst case, at least now they do the important one.