Extremely common in fintech and health care. It's the remote analog to being escorted out by security. I've worked for two health care companies and have had access removed the literal last minute of my last day. One, a large pharma co, used a policy update to remove my ability to log into the company laptop. Not a comment on the practice, only sharing experience.