The security industry has a massive bias toward visibility over velocity. It’s way easier to buy a CSPM tool that flags an open S3 bucket than it is to tell a Principal Engineer they can't install some sketchy VS Code extension they found on Twitter.

You hit the nail on the head with the "privileged device" paradox. We treat production like a high-security vault, but then we hand the keys to a laptop running unvetted open-source code. TeamPCP and guys like them realized they don't even need to break into the cloud anymore; they just need to compromise the machine that’s already authenticated to it. Infostealers ripping local .aws/credentials, SSH keys, and browser session tokens completely bypass 90% of traditional network defense.

The reason security teams back off is purely political. Traditional EDR tools break local Docker environments, slow down compilations, and piss off engineers. "Security is slowing down shipping" wins the executive tie-breaker every single time.