This isn't how it ever, ever plays out.
Also, most companies implementing this clearly are doing so out of some sort of compliance, whether it be SOC or otherwise. So yea, lots of times it actually is total performative bullshit. Congrats on finding the .000000000001% of cases where it isn't, if you are being serious here.