Email attachments and a few other mediums account for almost ALL nonmalicious leaks and MOST malicious leaks. Seems pretty good to me.

>Let's be honest with ourselves here, these measures are often implemented under the guise of security but really are just liability and risk reduction approaches

This is a fundamental misunderstanding of security. It is ALWAYS about risk and liability reduction.