Do you work in a field that warrants this kind of stringent requirements or is the security team overzealous? Do these kind of rules extend to using third party libraries etc?
Both probably. Most of these rules have come as a result of regulatory action/audit findings. Efforts to dial these back repeatedly get stymied by people demonstrating the need for such checks.