I recently had a run-in with security restrictions at work that only blocked the abstraction layer at the top, and were utterly surprised to discover that if you go down one level none of their restrictions did anything.

They eventually decided to keep their head in the sand and pretend like their restriction was useful.

The issue was a complete lack of knowledge of how the system actually worked one layer down.