As one of the devops/sysadmin types, if we give access to prod data to preprod systems, they are now in audit scope and you have to harden them or we lose our insurance and compliance certs.

Obviously the solution is to build some system where everything works out, but it’s not as easy as “just give root to devs”.