Someone on twitter explained it well: If you're in a regulated industry, you HAVE to use something like this on your machines.

When your auditor comes to sign you off, if you use CrowdStrike they check a box and move on, if you use ANYTHING ELSE they open a whole new sub-investigation.

So basically this stuff is legally mandated.