Again i ask the question: why am i left with the perception that end users have the ability to acess or install this in the workplace in the first place.

Any IT department worth it’s paycheque would already have everything locked down to hell. I work with a lot of local councils and they’ve grasped this concept