Ask an SAP Basis or security team how they control access to their ERP, and you’ll get a confident answer. User master records, PFCG roles, firefighter IDs, separation of duties policies, and an audit someone reviews regularly. Decades of audit findings have hardened those controls.
Ask the same team who can deploy code to their BTP subaccounts, and the answer is far from so confident.