Well, put too much inconvenience and some "smart" guy will circumvent it anyway.

I have not personnaly worked in industrial environment, but from people I know, security wise, it is very scary at some places. Here is one such example of a "smart guy":

The IT crew of a factory have a sane policy of deny all traffic, except some well thought out rules.

A supplier would like to open a remote connection for maintenance of the equipment. Since the process for opening some traffic for a short duration is so convoluted, they finally install a 3G card inside the equipment (without telling their customer, and they even make it a habit for future install) so that they can do maintenance whenever they want.

The IT crew still thinks all is safe from outside...