It's case by case. In this particular case with ArriveCAN, I can only tell you what I've heard from two members. I can't reveal their identities, but they were basically told, “We don't have time for governance.”
Don't get me wrong. There's a time and place to tolerate a bit more risk, but you have to realize what kind of risk you're taking and what your risk mitigation strategies are.