In bad orgs, yes. In good orgs you get appreciated for speaking up and communicating what will be future problems.

Ok and? Some people work in "bad" orgs.

We all can choose to either just follow orders or try to influence the direction.

Some caveats: 1. Nobody will be convinced to change the position on the first attempt, but seeds of knowledge can be planted in other peoples heads and some of those seeds will bear fruit later. 2. Being not nice, shuts down the passageway of ideas.

Usually this nonsense is driven by regulatory inertia out of control of the org.

It's usually driven by industry standards, not government regulations.

Many large orgs, even if individual companies are doing "fine" (not gonna say perfect, but also generally competent) have a parent organization that manages all this audit and policy stuff. In my experience the parent org is nearly impossible to change from the direction of bottom-up. I can get someone to forward an inquiry to them but it takes forever and from their side it's going to look like "hey boss, so, 4 of the 5 subsidiary companies passed the security audit already 2 months ago and the 1 that didn't pass is trying to tell us to modify the policy" to which they'd say "how did nobody else mention this? sounds like they are being difficult. Can we just hurry them along? The audit is already overdue and we need all companies passing for this quarter" and the response you'll get back is essentially "deal with it"