It depends what you’re allowing it for. For most companies, letting people use gmail with strong authentication and short sessions on personal computers that are patched, encrypted and up to date is a very small risk compared to the productivity gains. If you’re a bank and you’re giving access to an internal app with customer data or worse money then definitely not!