Even if people working in the field know, what is safe and what not, it does not mean, that the company, product or customer is safe, too.
First, if something goes wrong, you need to prove, that everyone did the right things. This is difficult of everyone had unrestricted access to everything. Think of a company with thousands of workers...
Second, if everyone has access rights, hacking one account of a company means, that the hacker has access to everything too.
Third, not everyone is always doing everything in good intent. If someone has been fired, they might be angry and just delete the most important files.
Da fehlt ein f. :-)