The main counter-argument I have is restrictive installation policies especially in Edu/bluechip IE you can do whatever the fuck you want in the sandbox that is your web browser but if you want to install some software you have to wait 4 weeks for approval then another 4 weeks to get approval for each update.
Also security updates/patches for native applications can be really shitty especially on Microsoft inflicted devices… For example, if you want to update Inkscape on Windows you have to do a whole download/install process. This can lead to security related issues…