For some it's probably a whitelist/blacklist situation and the ban is for the employees with elevated priveleges, not the typical employee. As a developer, I'm allowed a wide range of permissions including some Admin rights. However, my devices are still managed by the company and they turn on restrictions at any point.

This could be a situation where they are explicitly locking down the users that previously had extra permissions....but it's the government so maybe not.