Full admin is a non-starter for regulatory reasons in some industries (e.g. finance). Also, at Google, developer laptops are essentially untrusted - all code lives in the monorepo target than being cloned locally, so there's nothing of much value on the device.
Nope - even local admin is generally a non-starter as it can serve as a gateway to further attacks (e.g. install a keylogger, wait for a coworker to need to check email and offer to let them borrow your laptop, run pen test tools from with the network to probe for weaknesses). Banks actually have to prove to their regulators that unauthorized software can't be installed.
