This depends massively on what the company is actually doing.

Some generic SaaS company or tiny startup, yes, engineers should have root access to stuff.

A financial company as big as Binance, though, I'd expect a lot more controls.

Security isn't one size fits all, you need to determine what makes sense for your situation.

Please do not stay quiet. I think most of us know how incredibly difficult it is to lock things down without there being holes, and without impacting the team culture and killing productivity. If you managed to do that you have a lot of contribute.

Please don’t stay quiet.

If it’s anything serious like a bank or critical infrastructure, hosting, sensitive data? Lock. It. Down.

This is common in a lot of companies but specifically not for crypto custody due to insider risk. If an insider can jackpot for $6B by running a command on his laptop, either a malicious insider happens, or someone applies $5 wrench to the engineer or his kid, or takes over his laptop. It is like parthenogenesis.

In the real world, a great many regulatory rules — possibly the vast majority — are routinely violated in the corporate world. While many are well-meaning, and in theory, beneficial, I suspect total compliance would lead to the economy grinding to a halt.

I'm assuming a similar 'routine flouting of rules' is the rule in the public sector as well, and routine even in the regulatory agencies charged with enforcing the rules.

Revoke licences then. Close shops. Seriously.

“X Y Z got hacked by A B C state actor”

Outside of something as spicy as stuxnet most of it is social engineering plus poor hygiene mixed with cowboy shit.