I once worked on an air-gapped network. I programmed my own Klondike Solitaire, Freecell Solitaire, and Hunt the Wumpus games. The project was named "LBus", which was short for "look busy". I made the user interface look like log entries in a console window.
That's why perimeter defense doesn't work. You always have to let at least one person in, and any person you let in can become an insider threat--especially if their job is to write source code, compile it, and run it. If I need a script or simple program, I wouldn't bother trying to clear someone else's through security if it were easier to just type it in myself.
I feel slightly bad about slacking off at work in that manner, but I still completed all the tasks that were expected of me, and even got actual cash bonuses for exceeding work expectations. That workplace had absolutely no mechanism in place for exercising ambition or creativity, so if that entire department hadn't been destroyed by unethical (and, as I later learned, illegal) contracting practices, I probably would have also eventually devised a way to make Tetris look like the TPS Reports.
It wasn't the worst job ever.
But yes, internal security is a must. At minimum, keep the overly clever people with access to compilers in their own sandbox, away from everyone else. It seems odd to tell someone they can't have a compiled binary when they can just sit at a keyboard and type in "int main (void){ while(1) fork(); }" just for giggles. It's like giving someone a .50-cal rifle and then denying them a 9mm pistol.
It is an actual security issue, but really, as a developer, I just want different security restrictions on me than the non-developer users.
I have a compiler and the ability to execute any code I can imagine. In what network would you not want to wall me off from everyone else?