Security for example. Every new things needs security review. How does this fit into the Netflix “freedom and responsibility” concept?

Probably, but not every bad thing happening requires a response. Sometimes mistakes or bad things happen, and you just say, "use better sense next time", and then you move on.

The pernicious part happens when those ancillary functions become conflated with the business itself, at which point it is far too tempting to further expand the beurocracy to service those functions (i.e. auditors). My sense is that the most despised rules in most organizations are such second-order attempts to service the beurocracy.

An common example might be the procurement department, whose purpose was originally to facilitate and track purchases for the business. Maybe at first they managed and distributed credit cards to employees. However, this is still inconvenient when employees make innevitable mistakes. Instead of dealing with this inconvenience, credit cards are eventually taken away from employees and an online procurement portal is set up and/or people are expected to file reimbursement paperwork after trips. Now the beurocracy has effectively shifted its own burdens onto individual employees while making the process slower, more complex, and more expensive. Despite all of this procurement will now be considered a core pillar of the business because executives look at all that sunk cost and fallaciously conclude that the procurement beurocrats are indespensible.

Meanwhile, there isn't really a similar mechanism at play to protect people doing the actual work.