> how often do you need to install brand-new non-standard software?

That depends on the definition of non-standard I guess. If I want to quickly throw together a proof of concept product I might need to grab node/npm/postgres/ for example. Waiting even a half day for approval is too much in that scenario I think. So it's problematic in some situations to have an approval process. But in a typical month I'd say it's around once or twice that I need to run new software.

Some times I feel that we should just take the opposite approach. Don't trust employee machines! In my work I just commit code to a repo that isn't on a company machine anyway (github/azure devops etc). I don't use documents/network shares/databases/vpns whatever that is on a company network. I could work on my personal machine and no one would notice.

The threat model for a laptop connected to a private github repo is what? a) that a compromised machine can be used in a supply chain attack, and b) that a compromised machine could be used to read secrets/IP from the private repo. That's it. I wonder whether that threat, for normal "low risk" development work is worth the hassle of even bothering with locked down machines?

In some situations I have resorted to running tools inside a VM on my dev machine, where I can play god if I need to. But really this isn't any different from the above. There is a machine where you can do anything, and which hasn't got access to anything sensitive.