So, if an employer values compliance over productivity, they should make it a criteria in their performance reviews, and the employee who is producing only a third of the output using company approved tools should get a much bigger bonus than the employee who produced 3x as much getting creative paying for their own tools. As long as employers value productivity over policy compliance, good (as per performance eval criteria) employees will always find ways around the policies.
The way it is supposed to work is that policy is not optional and not a factor in performance reviews. You break it, you're out the door, or maybe you get called up on the carpet by some CorpSec manager who makes it clear to you you'll be out the door next time. BUT... not getting work done due to the corporate policies is not an excuse, and that WILL count towards your performance review. You tell your boss you didn't get shit done because your laptop was locked down tighter than San Quentin, and you'll be PIPped out of there in no time. So if you can violate the policy to get work done, you're better off; you might not get caught but you will be fired if you don't get the work done.
Looking at CorpSec's own incentives, you can see the problem. If the company gets hacked despite their policies, they take the blame. If the company gets hacked because someone violated their policies, they only share the blame (and they can then do a crackdown to get the heat off). If work slows down due to their measures but the company does not get hacked, they get no blame at all. The only caveat is the computers still have to work for important people -- execs and their secretaries, and salespeople. Fortunately for CorpSec this mostly means email, docs, and spreadsheets, which are easy to keep working even with a draconian security policy. So basically they're incentivized to make things absolutely as hard as possible beyond those basics. Want to run an unapproved program? Here, fill out this form, get your manager, director, and the VP of engineering to sign it, and CorpSec will get back to you in 6 weeks with a "No" citing an alternative way to do it with already-approved programs that gets you half of what you want at 10x the work... but doesn't require CorpSec to lift a finger.