It's surely about security reasons. If the user does not know how to use VBA, then maybe he is a lesser security threat (at least that is exactly the reason they told my father at work about that problem !!).

The point that people could use the internet (sometimes even from the same computer), well, that's the responsibility of someone else I guess.