One phrase or attitude that reallly grinds my shit is “but X org does this and they have tighter security requirements than you”. Especially from vendors.
Firstly, that org are fucking idiots then, quote me. And second clearly they don’t have tighter security requirements than us if they’re fucking doing it.