I'd say the point is valid though if the only function the tunnel is supposed to fulfil is channelling traffic from and to a web browser.

As far as browsers go, only Internet Explorer lacks SOCKS5 support. And I doubt an office which such stringent header filtering has an IT department that doesn't provide people with proper browsers...