We have a similar value prop with our platform (we store PII including actual identity documents).

It's not about making it impossible for users to download and store sensitive data. Everyone knows that that's impossible - yet somehow Snapchat and its disappearing messages is still a thing.

Instead, it is intended to be coupled with policies. As long as the company has a policy against downloading/storing confidential information, then the company is covered.

Then, when a case of e.g identity theft happens through a rogue employee, the company can demonstrate that it has taken all reasonable steps to avoid it.

That is a much better position than showing up in court and saying "yeah, we didn't try to prevent people from downloading PII, that's impossible anyway".

MANY employers have folks who unless you put a speed bump in their way would have employees inadvertently sync their entire email history onto their kids computer or a random computer while traveling.

The ENTIRE POINT of MANY of google's settings is to allow for those railings to be put in place. This is so employees who aren't out to abuse data can go about their day with reduced risk of inadvertently screwing up.

This is a big risk factor (I'd argue a much bigger risk factor than intentional employee misbehvior).

Additionally, once these controls are in place you can actually drive even better security where needed - it is possible to do a USB / printer / no phone lockout for high security ops - and is done when needed (very rarely). Thin clients are actually popular here - remote desktops another layer making it harder to dump the x million records out of system.

Many companies have strict regulations on data retention and they’re regularly audited to ensure compliance. By keeping the data off employee computers, compliance is simplified.