A lot of it is security theater plus lazy (as in "doing the minimum amount of work possible") compliance with regulations