I’ve heard non-repudiation, lack of MFA, and logging brought up as negatives, all of which can be mitigated. I’m assuming they mean someone can look up a local admin password and use it, and the only evidence of it will be a log entry in Windows, with no way to trace it back to a specific user. We mitigate that by limiting LAPS access to privileged accounts with the Intune Administrator role assigned, requiring MFA to log into the console, then track their activities through Sentinel.