I think he is saying that often people have a legitimate need and security professionals should try understand these needs and not just say "No".

In my company IT puts all kinds of restrictions on the network but for automated testing we need these restrictions removed or we can't do our job. Since IT didn't accommodate us or provide an approved workaround we had to hack around them and make the system less secure as a consequence.