There’s an old but IMO still very relevant white paper by Microsoft titled “So Long, And No Thanks for the Externalities: The Rational Rejection of Security Advice by Users”. It argues that security measures often cost more in employee time (and hence wages) than the potential benefit. It’s an interesting read and I think about it whenever our chief of security cooked up with another asinine security measure.