Exactly! Either developer laptops are part of the network that has access to lots of very sensitive data (and get treated accordingly) or they aren't. There's no sane middle ground where developers have infinite free reign and root on their laptops while also doing dumps from production databases of PII.

There are a lot of situations where people tolerate less sane practices because they are convenient, but this isn't a good strategy.