People being good at anything else (let's say, accounting) is not correlated with safe/smart computer use habits. If you can prevent a lot of turmoil by not letting them install arbitrary programs and still keep them happy and working well on their main role, why get rid of an otherwise good employee?

I think it's useful to distinguish between types of trust. You might trust a mill operator with $5 million worth of automated equipment that has a well-documented UI backed with years of training and industry support. However, you might not trust that same operator with unfettered control of a $2000 general-purpose networked computing device that can silently leak company secrets and offer a foothold to attackers inside your firewall _even if the operator does nothing obviously wrong_.

Very good question!