Your advice is worse. Situations like this are entirely a game of dick swinging. If the IT department wants to become a room of ineffectual little shrinking-violet yes-men, then why would you want to work there in the first place?

I get what you're saying, and I think that most corporate IT departments run themselves as little fiefdoms with false pretensions of importance and power. But if someone is insisting upon running systems that don't conform to reasonable standards of the company, then something needs to be done. I would consider requiring that device to be isolated from the network with a small firewall.

But the waiver is a good idea—though unlike your assumption that it would be handled by an junior, such matters ought to be sent up the chain to the CIO or equivalent, and it should be the responsibility of the CIO to get the signature or take personal responsibility themselves.