How least privilege becomes the guideline for *

One of the best-kept secrets in security: in theory, everyone roots for the principle of least privilege. In practice:

1. Team A, doing something for the first time, starts with the permissions they think the task requires.
2. They realize it isn't working because of permission issues.
3. They switch to * to make it work first and worry about permissions later.
4. It works, and they move on. Figuring out the exact least permissions isn't a blocker.
5. ⋮
9. Team B has a similar task. They copy and paste the permissions, assuming Team A already did the due diligence.
10. ⋮
15. The platform team documents it and publishes it as the guideline for all similar tasks.

And one day the vulnerability is abused, causing a loss. Then comes the mandate to hire security engineers and review everything.