From the bullet points:

Fine-grained access control needs domain-specific understanding

This also applies to the user trying to configure it. For all the reasons listed in "weland"'s sibling comment, this is hard to learn. If something doesn't work in polkit, and you're not completely familiar with it, it's very hard to make it work.