This is a great tale - and clearly an obvious vulnerability. Most of the situations I've entered into are less clear cut however, its organizational policy choosing the easy way out (and being able to tick the 'best practices' box at the same time) over more practical solutions that actually work for a majority of the needed users.