It really depends on your threat model. It is not always unreasonable.

Target trusted their HVAC management firm so much that they had full unsegmented access to the LAN in each store. The credit card swipe terminals in the same LAN were totally compromised and millions of users had their credit card credentials stolen.

Defense contractors and places that store / manage large amounts of money are totally within their mandates to trust no one, not even many of their own employees.