The problem is that if you implement security that is too strict, then employees will find ways around it that are even worse than the more permissive method. I don’t disagree that people should have the minimum access required to do their job, but if it isn’t proprietary then the controls should be relaxed, and if someone requests access to something it needs to be responded to immediately so they are not delayed in whatever they were trying to do.
That kind of irrational fear of implementing good security is a big part of how bad security happens which leads to breaches.
Doing your work securely should be the norm. Each person should have the least privileged access they need to do what they need.
The problem is that if you implement security that is too strict, then employees will find ways around it that are even worse than the more permissive method. I don’t disagree that people should have the minimum access required to do their job, but if it isn’t proprietary then the controls should be relaxed, and if someone requests access to something it needs to be responded to immediately so they are not delayed in whatever they were trying to do.