I think the advice is based on "peace time" management, during more comfortable profitable times, leaning towards more centralised control. There's no appetite

I think the advice is based on "peace time" management, during more comfortable profitable times, leaning towards more centralised control. There's no appetite for the risk of moving faster by removing approval bottlenecks or changing processes. The advice here is to challenge what actually needs to be centralised. Identify things that could be safely delegated. For example, why does a list of managers and an exec need to approve a $10 per month subscription that saves a bunch of engineering time by managing cascading PR merges? And identify safe ways to delegate. For example, if we move container image vuln scanning into CI/CD pipelines, the dev team can update dependencies themselves without a security team being involved to do it for them and approve. These might seem like silly examples to someone working at a half decent start up or tech first org. But these kinds of centralised control structures are the norm for most large organisations until they are very strongly challenged.