My feeling is companies leave themselves open by allowing everyone access to the network so the idiot who has been told 50 times not to click on a link in a suspicious email will still do it or hand out passwords to anyone on the phone. Even if you run a tight ship you'll give access to some contractor who doesn't.