There's a spectrum of options between "total lockdown of machines" and "nothing is controlled". Also, at least the way the announcement read at the time... it felt like someone forgot that there might be a need by local admin to disable it, in fact.