My guess is that this works just like how it does in corporate security: It is vastly easier to add a new security policy than it is to remove it. Even when everyone knows something is useless or perhaps even harmful, nobody wants to be in a position to be held culpable on the off chance that retiring the policy is implicated in a future breach.