Yeah, so then you figure it's a great idea to put every VM and the resources only associated with it in all separate resource groups.
Now say you want to give someone access to a bunch of VMs but not all VMs in the subscription. Well, you can't nest multiple resource groups under a parent resource group. You could move them to another subscription and give that person permission at the subscription level.
But hey, what about Azure AD groups? So you create an Azure AD group and assign that group permission to each of the resource groups. But there's a limit to how many individual permission assignments you are allowed, and guess what? Now you've created a back door that would allow an Azure AD User Admin to give themselves access to your servers and resources.
The solution? Azure AD Administrator Units, create a whole new Azure AD Admin unit that does not share User Admin roles with your normal Microsoft 365 tenant, but guess what? Now you need to get licences that include Azure AD P2 for some people in order to use Administrative Units.