To folks out there: do the important work, not the glamorous work, and you'll not only sleep well, but you might actually matter as well.
And their actions impact far more than just my own account. Is it inconvenient? Yes. Does it work? Yes. Is it perfect? No, absolutely not but it is a useful layer in the cake.
After all, workers are mostly working in an access-controlled office or their private home; and your endpoint protection will be ensuring they're connecting from a company-issued laptop and that they have screen lock on a timer and a strong password.
I'm already validating something-they-know (FDE password) and something-they-know (OS password) and something-they-know (SSO system password) and something-they-have (company laptop). And once a day I'm validating another something-they-have (TOTP code/Yubikey).
Asking people to provide the second something-they-have several times a day seems like security theatre to me.
It went a lot worse. The guy had no idea about security and no common sense, and did genius things like forbidding encryption in the name of security (so the network people would be able to do packet inspection for monitoring security). But he created a morass of paperwork, and made it impossible for any project to make any kind of progress without involving security. End user computers slowed to unusable speed as he threw in more and more snake oil security software. As his rules were vague, dumb, self-conflicting and very very time consuming, nobody followed them, so he could always point to someone not following the rules when a security boo boo happened. He grew his department like a mushroom, wasted huge amounts of money, and entrenched himself completely, all based on sweet talk and complete nonsense. I've learned a lot about office politics watching him.
Serious injuries or deaths is a terrible feeling, even if the end result was better safety for the rest of the workers.
Fun times.
I was doing the QA on a life safety product. Any new hardware would mean pulling the specs for the ICs and verifying that the layout and pin-out where correct on the product designs. You don't need an electrical engineering degree to know that PIN-1 on IC-2 should be connected to PIN-A on IC-4 but deigns having it traced to PIN-C.
Not once was there ever a recall and all early product issues where just a firmware update. After no longer working at the company they stopped doing QA. Heard from a former coworker that they latest product releases have required a compete recall.
QA not only saves lives it also reduces service and support costs. It helps keep a good standing relationship with your clients. Good QA is about trying to brake the solution as a consumer not reading the manual.