You are completely correct "there are reason to make improvements..." However, it really depends on the facility, the personnel, etc. Personally, I'm not one to make improvements just for the sake of "improving" if it doesn't reap a benefit or it doesn't fix a problem. Usually, you end up with a completely different problem or just move your "herbie" somewhere else.
Think about root cause as to why employees are in the plant with foodstuffs. Is it really the vending machines? Or....employee habits and lack of proper training / enforcement around foodstuffs in the plant? I tend not to treat associates like children and at least give them a chance to show they are not. If they can't abide by the policy then you focus on the associates, not the foodstuffs.
If there isn't a problem with foodstuffs in the plant then really what is the point? Sure, there is "some risk", but there is risk with everything. I would actually be more concerned about the associates response when this change is made. I'm sure a lot of negative reaction and then what is your point when you have to respond to those associates? "Well, the auditor thought it was a good idea and I see his/her point even though it's not specifically in the code. It is a risk." Then the associates, if they have a head on their shoulders, would ask, "What risk?"
It just seems like an absurd rabbit hole that doesn't end well in the long run.
I'm going to join the minority here. No, it might not be a requirement according to BRC, but the removal of such candies would people to keep candy out of the areas where product is exposed, so I would absolutely remove the hard candies, etc. There are reasons to make improvements that are outside the strict GFSI requirements.