Because then you don't impede people who might need a new widget installed because everyone and their mother in IT needs to try it and test it before you can use it.
Especially at Google scale, where the BeyondCorp system described in their papers could automatically see when an endpoint was doing something naughty, block the user from accessing corporate resources, and give the user information on how to fix it, instead of blocking them from installing anything (even if what they want is perfectly harmless).
Especially at Google scale, where the BeyondCorp system described in their papers could automatically see when an endpoint was doing something naughty, block the user from accessing corporate resources, and give the user information on how to fix it, instead of blocking them from installing anything (even if what they want is perfectly harmless).