IT is directly responsible for a lot of those things. In some places, it seems like IT departments try to make their own lives easier by ensuring the infrastructure is so ridiculously constrained that nobody wants to use it (no users = no things broken by users that need fixing!). Users instead will make due in creative ways, which make organizations vulnerable (and people unhappy).

Of course they'll say it's for security reasons... and indeed, the most secure network is one that no one uses.