The other half think it's bad because they can't steal everything that's not nailed down.
It's like trying to censor speech. You get rid of "bad" speech but you also get no interesting speech. Is it really worth it?
But it's very nature is anti productive. By this I mean, documenting, discussing, approving, and creating boundaries, all work to slow down an organization, even though it's necessary to ensure the wellbeing of the organization. As a specific example, organizations often have separation of duties for certain things (like activities involving pay to avoid embezzlement from happening), but doing so naturally slows down the handling of these activities. If one person has to do his part, then write documentation to instruct what they're trying to do and what they need someone else to do, send those instructions to someone else, wait for their approval, and then send it to someone else to process it... all of this is slower, than if the person who wrote the instructions, skipped writing the instructions, and approved and processed it themselves. But obviously that can result in some bad situations, and hence why some bureaucracy is inevitably necessary.
This will keep happening to even the most incompetent person cannot do anymore harm. Meanwhile top performers leave. AFAIK the best way out of this has been Netflix's "freedom and responsibility". You expense crazy meals, you get a warning. You do it again, you are fired.
Security for example. Every new things needs security review. How does this fit into the Netflix “freedom and responsibility” concept?
Probably, but not every bad thing happening requires a response. Sometimes mistakes or bad things happen, and you just say, "use better sense next time", and then you move on.
The pernicious part happens when those ancillary functions become conflated with the business itself, at which point it is far too tempting to further expand the beurocracy to service those functions (i.e. auditors). My sense is that the most despised rules in most organizations are such second-order attempts to service the beurocracy.
An common example might be the procurement department, whose purpose was originally to facilitate and track purchases for the business. Maybe at first they managed and distributed credit cards to employees. However, this is still inconvenient when employees make innevitable mistakes. Instead of dealing with this inconvenience, credit cards are eventually taken away from employees and an online procurement portal is set up and/or people are expected to file reimbursement paperwork after trips. Now the beurocracy has effectively shifted its own burdens onto individual employees while making the process slower, more complex, and more expensive. Despite all of this procurement will now be considered a core pillar of the business because executives look at all that sunk cost and fallaciously conclude that the procurement beurocrats are indespensible.
Meanwhile, there isn't really a similar mechanism at play to protect people doing the actual work.