What the GP is talking about is not letting developers install stuff on their PC. I assume this is also "run unknown exe" because.. well I can't see any reason local root could hurt the network in a way my user account couldn't. Unless maybe the PC is shared, there's no difference of install (local root) compared to run as normal non-user, as far as attack surface on the network.

So this comes back to: do you block "potentially malicious" executables or not? How do you tell if a new never-before-seen executable needs to be blocked, without either just blocking every unknown executable ("dev can't get anything done") or opening a giant loophole ("anything in x directory is safe")?

Let me write it a different way: An exe with an unrecognized name and unrecognized sha256 suddenly appears on my computer. Maybe I just compiled it from source I wrote, or maybe it is a random thing I downloaded and unzipped. How does a decision get made on whether my system will run that or not?

Your local non root user can install new network drivers and launch ARP attacks against the switch in promiscuous mode?

There are plenty of ways for a local dev to self sign local trusted executables that can only run on their own machine for testing purposes (that would not be trusted being distributed to the public).

At least in Windows there are a few different systems that protect against running unknown executables, and downloading and running unknown executables would be a resume generating event that would get you walked out the door by security.

With this logic we don't need IT policies, because I just don't run malicious executables. Thanks to that I can run a graphical session with root.