For the IT department it's a tradeoff though; they'd rather have everyone be inconvenienced or their hardware not working at 100% than to risk a virus wreaking havoc on their networks, or ransomware crippling their whole organization. Even without the restricted Windows machines they struggle with enough shit already, because people can't behave on company hardware on the one hand, and every employee is a target.