Would the extra attack surface from third-party apps looking at sensitive system data outweigh the benefits from an EDR solutions? Poking a hole in the sandbox

Would the extra attack surface from third-party apps looking at sensitive system data outweigh the benefits from an EDR solutions? Poking a hole in the sandbox for "security" or "auditing" seems a bit risky.