It's less stupidity and more "if we don't prove that we meet x control in y compliance framework, our auditors will deem us non-compliant and we will be fined into oblivion"