Dunno, just reporting what I understood to be. It may be a distinction can be made between company-internal and company-external attempts at access, but that is pretty risky.

Any solution to the valid point you have made would have to be organisational.

But the saying goes something like "security annoying, good security is very annoying" - anyone know the original?