It's not meant to be a comprehensive security plan, but rather a very easy thing to have configured on each port, to stop people from plugging $20 8 port dumb switches into managed infrastructure.
And again there’s no need to be so draconian on something like a ResNet.