I really don't know how to answer your first question without sounding a little rude so you'll have to forgive that but the bottom line is if the IT dept. gets to pick which sites are productive it's because the company has entrusted them to do so and the company owns the equipment so it's their right to control how it's used. Though a good IT dept. will listen to individual employees and allow sites they might not normally allow if there's a good reason.

On Gmail the question was "why were they banning Gmail" not was his personal use of gmail a violation so the point still stands (though I'll admit I read it wrong)

Finally, if your security gets circumvented than your security is flawed. Any IT department that chooses not to implement security on the argument that it will inevitably get circumvented probably needs to re-evaluate how they're handling things.