This is a great point. If something is overly complex and arduous often times people will find a way to go "under the table" and do something in a way that accomplishes the goal but undermines the process.

The classic example is password rotation. It used to be standard to force users to rotate their passwords every 30/90 days, but that led to users having a sticky note on their monitor with their password on it, so security authorities no longer recommend this practice.

My work still forces password rotations. Everyone I know jokes about just changing the last character of their password each time, eg horse-staple-battery-1 to -2 to -3 etc.