I would hope that the point of security systems would be to make the company secure.

Being bureaucratic and following "proper" procedures ranges from being a way to achieve that goal to being actively counterproductive. It's not exactly rare for a "proper" procedure to be optimized for CYA, compliance or security theater at the expense of actual security!