One big problem is misaligned incentives. At most big orgs, you have an infosec dept with authority to put all kinds of virus scanning, etc etc on every computer in the org. They get rewarded if there are no incidents; they do not get penalized if they make your machine impossible to use.