This. Anything that contributes to an adversarial relationship between security and other parts of the business is a net security loss.

Skipping the things you’ve mentioned,

Best: Managed Ad blocking, password manager licenses for all employees.

Worst: “secure” email portals, phishing training, needlessly draconian vulnerability scans without context