This shit is usually from "security" which, in corps, is just endless list of boxes that you need to check and are handed over manager to manager. Everyone is scared to actually remove anything from the list because nobody knows who is actually responsible for maintaining it; getting through the hierarchy to even find such a person would take a month; if you find him, he will tell you "oh it's for compliance with <some mysterious government/iso/owasp document that's 20 years out of date>, safer to keep it there"