These anti-features are almost always a requirement coming from either a cyber security or compliance department, not from product or engineering.