+1, well said.
"but how many would remember to do that on the day and how many of those would need a change request signed in triplicate to get privileged accounts changed "just in case something goes wrong", even though something worse can go wrong without the approved change."
Not many approaching ZERO as HR and other less tech savvy departments usually have to be involved too. The cloud? Isn't that where we keep our stuff?