How is this different than any other access control system?

When you frame it that way, it’s really not that different. The issue isn’t the access control system itself, more so that it’s really asking too much of people who don’t have the skills or understanding to manage it. Teams of trained professionals get it wrong when the scope is limited to a single application or suite of applications, and you think grandma is going to properly manage access control over her entire digital footprint?

Well, its maintained by humans to start with, peer reviewed by humans. They fuck up from time to time in extremely limited scope, depending on how much given company is willing to invest into getting quality work, but nothing like this. Humans are clearly not the weak link to be automated away, in contrary.

I work in one of the special legal jurisdictions, such fubar would normally mean banning such product from company for good. Its micro$oft so unfortunately not possible yet, but oh boy are they digging their grave with such public incompetence, with horrible handling of the situation on top of that. For many companies, this is top priority right behind assuring enough cash flow, not some marginal regulatory topic. Dumb greedy amateurs.