I’m one of 7 IT people in my company….if someone wants to even download something as mundane as MS Paint, they need us to remote in and temporarily give them privileges to do so

Your question is on point and well directed. The county should have more controls in place to begin with, 100%. But security always has an inherent trade off.

My only answer is that it takes a lot of man power, money, and red tape to effectively control devices like that. Remember, while Lancaster County IT and security folks are taking directives passed by CISA as well as the state, they're pretty much on their own for actually implementing and controlling stuff like that. It's not like they get some PA or fed sponsored software that does what they need; as I understand it's on the county to contract with vendors and implement their tech.

Yes, it's very simple and not too staggeringly expensive to lock down these devices with JAMF or whichever solution. But, that also comes with a ton of downside. You now have tickets and calls and ornery users and delays resulting from needing your help desk folks to go resolve app install requests. You're worried about where these packages are sourced from, so you're either maintaining your own repos which is a ton of work, or trusting the app store. You might be manually maintaining a whitelist of apps users can install without further authorization, and you still need to have a mechanism to actually stop them from breaking the rules.

Security comes from a simple idea, but the reality of making it happen is WAY more complex, especially in a government environment where change will take years or decades. I mean, look at the timing of this announcement, versus the exposés published ages ago showing how TikTok aggressively harvests metadata and could previously even see the contents of your clipboard. It took all that time for a decision to be made and a control to be implemented.