Same here. It is trivial to keep it on a private network or behind an SSH tunnel or a SOCKS proxy or _anything_ that limits access to just yourself until it is actually ready for random visitors.
Many Wordpress sites are not set up by developers or technical people. A significant number of them are set up by marketing teams just spinning them up in a cPANEL or GoDaddy or something.
because their IT group "would just slow us down"
IIUC those tools would usually prompt you for a username and password as part of the installation procedure, so your installation would be secure right off the bat.
That is literally the opposite of an excuse. cPanel, and any other hosting provider, has all of the tools needed to implement this correctly. The user wouldn’t even have to leave the browser.