My guess is a device was named "Bomb" or something.
Other than that, I can recommend going for IoT devices like VOIP phone MAC addresses in conference rooms, because they're specifically allowlisted for everything and/or are in a different VLAN that doesn't block the endpoints.
Enterprise-grade security is always fun :D