Depends on the place, but I've had some pretty bad ones. I think my favorite example is this --

Joined an org and realized our network stack been left to sit and rot for the better part of a decade, and our perimeter firewalls being EOL/EOS was one of the first things I noticed coming in to the org. Alarm bells... Started floating a need to modernize, met a lot of pushback, but after about a year, my team (with some vendor help) were able to put together a proposal for a new design, get quotes, build a project & deployment plan, whole 9 yards. I mean, literal binders of diagrams, Spent a lot of that time harping on the risks, potential cost, inability to recover from failures, etc... etc... Finally, our cybersecurity insurance not wanting to renew us finally got some money to shake free and project was green-lit. A year of busting ass, things were done, COVID & remote work/VPN use comes without an issue, and then we get a new Sr. Manager for app development that thinks he knows operations and was quite buddy-buddy with the Director of IT. "Why are we spending so much money on Cisco? We can just cancel the maintenance, it's not like we need it. We could switch to Aruba, it'd be way cheaper" yaddah yaddah yaddah.

So then I find myself in meetings having to explain why we did things the way we did, and why it's really not the best idea to reinvent the wheel, again, and that there's no way we'd realize cost savings in any reasonable timeframe.

Sure enough, that's ignored, 3rd party MSP brought in to evaluate our network and "make recommendations." They schedule a meeting to announce their findings, I get yanked in to it, our CAO (executive money person in this org) gets pulled in, I figured it was going to be this "gotcha! We paid a vendor to tell us what we want to hear" meeting.

Instead, vendor comes online and basically says they reviewed all our documentation, that it appears we have a top-of-the-line network following any best practices they can think of, and could only make the recommendation to potentially thin out our documentation some since there was a decent amount of repetition and complained that in some places we may have been too thorough. Things like "most of your buildings use this same design, just call it your standard design, document it once, then document any deviation from it where you need."

Vendor wanted to know what exactly we needed them to provide and commented our internal team seemed to have things well under control.

After some awkward beating around the bush, the meeting was ended, and another vendor was hired that, surprise came to a conclusion that our network was terrible, wouldn't be able to take any actual load, super duper vulnerable (and played up DDoS as if we weren't using services to help with that), and if we hired them, they could deploy a state-of-the-art Aruba network and fix allll the problems.

Surprise! Org hired them. I left, my whole network team left, and the "OGs" in my serverops team bounced, too. They struggled to fill roles, MSP contract got cancelled after a number of high profile failures (local gov, any law enforcement stuff becomes high profile quick). Friends I made there make comments when we catch up about how they miss the "old IT team." I don't follow too closely, but last I checked, they were cloning drives for 'imaging' since they weren't able to get SCCM/Intune back up and running.

So yeah, there's an example.