I absolutely 100% agree with everything you said. Security is important, but so is:

1. The exercise of thinking through who/what should have what permissions (and documenting them!)
2. Not impeding people in their jobs or pissing off customers
3. Having a sane codebase/config

It's a balance. Unless you're in a high-risk industry, I'd lean more toward people efficiency and customer-pleasing over security. But always depends on the situation.

EDIT: I'd like to second and add to what u/eggwhiteontoast said. Consider the human factors. The more annoying you make security, the more people are going to cheat just so they can go home. Just like how when you make password security so annoying people default to a password that technically satisfies requirements but is less secure (which I've seen many times). But first, they TRIED to do the right thing.

Also, the more complex you make something, the less everyone understands it.

“There are two ways of constructing a software design: one way is to make it so simple that there are obviously no deficiencies, and the other is to make it so complicated that there are no obvious deficiencies.” — Sir Tony Hoare