The two failure modes
Applying the same authorization rigor to every operation, regardless of stakes, has a predictable cost: routine, low-risk actions become slow, and people — understandably — find ways to route around friction that doesn't seem justified by the risk. That workaround culture is itself a security problem, often a worse one than the friction it was avoiding.
The opposite failure is subtler: without an explicit definition of what counts as consequential, that judgment call gets made independently by whoever is building each feature, at whatever time pressure they happen to be under. The result is inconsistent coverage that nobody can describe accurately after the fact, because there was never a single decision — just many small, uncoordinated ones.
What a workable definition looks like
A consequential action is usefully defined by its effect, not by which team owns the code that performs it: does it move money, change a production system, alter policy or key material, or send something to someone who wasn't expecting it? Naming these categories explicitly, once, gives every team building a new feature the same answer to 'does this need a gate' — rather than leaving each of them to guess.