Another way of thinking about it is that the security team is supposed to help other people do what they want to do securely. If X is insecure, make it secure. Now, if you're an IT department at some corp, you probably don't have the budget or the manpower to do that, so you have to say no as much as you can get away with it.

But when the Secretary of State wants to Do A Thing, and you're the NSA...