Yes and no. The friction they should have probably had here is: did this employee need access to 3,800 internal repos? I'm with the poster above in believing

Yes and no. The friction they should have probably had here is: did this employee need access to 3,800 internal repos? I'm with the poster above in believing restricting what you can install makes a lot of things more difficult, but if you're going to take the risk you should be limiting the blast radius.