I think people are more rational than given credit for. Their decisions are not necessarily rational for the company, but they are often pretty rational for themselves.

And some bureaucracy is often necessary to evaluate security, data protection agreements, etc.

Some companies are not efficiently allocating resources and so projects sit in legal/security review for longer than is reasonable, but it makes sense that individual developers don't have unilateral authority to use 3rd party vendors.