It's been my experience that default-to-no is what happens when groups like security try a reasonable process... and find that marketing and similar enablement-first groups handle this by ignoring and bypassing it. This tends to set up a very ugly reckoning at some point. Marketing will lose, but the company overall will lose too.

If marketing ever says "But an enterprise contract with SAML is too expensive! Can't we just use the basic SaaS version?", it's time to check what other processes they're used to ignoring. I'd suggest starting with expense records. There's probably a bunch of vendors handled entirely on a director's credit card.