It might be a generational thing, at some point I know people actually had Napster running on their work computer, or were torrenting porn movies. That's how the whole Metallica thing happened. That feels absurd to me in today's corporate env., for better or worse the work/private split has really come a long way.
Malware spread by physical media was also a thing for a while, it's not just about the getting stuff out, a lot of the restriction on USB is not getting things in.
PS: on the "why" of all that...I'd say Windows. Platforms all have their weaknesses, but Windows opened the doors wider than anyone else IMHO.
Far easier to say no to everything, that way either your manager takes the blame when they overturn your decision or your are blameless when Shadow IT takes over.
That, and it allows you skip the troublesome business of userstanding user needs.
Like many principal-agent problems, it requires someone appropriately situated to weigh the costs and benefits.
If that doesn't happen, it gets borne by someone, usually shareholders who pay in reduced profits and eventually capital destruction as these companies get ossified and disrupted.
I know for a fact that none of the people doing systems administration that install this junk endpoint management software actually want to install it. And it's laughable that corporations can simultaneously claim to be implementing zero trust, while at the same time giving crowdstrike software more trust than anything ever had before everybody decided they wanted to chase buzzwords. It can take weeks for me to get a new hire set up with WSL right now. If I didn't like the people I work with I would have jumped ship a long time ago.
Security teams have managed to threaten and bully their way into having more power than anybody else in IT. All the big stories about hacking is certainly part of it, but honestly I don't think that fully explains it. If I was a CIO paying an enormous amount of money for endpoint management and then saw something like solar winds happen, I'd probably have fired everybody on the security team that advocated those sorts of security strategies.
In my mind, security is something that should happen deep in the backend and be handled mostly by programmers, DBAs, and the admins that handle application servers. Once the data has left those environments with somebody it shouldn't have you have already lost. No hacker has ever said "I breached the database, but then got stopped from exfiltrating data because somebody made it so the USB sticks don't work".