The most important difference is that in practice the SWE can't go and report the employer to anyone for breaching e.g. occupational health and safety laws, or

The most important difference is that in practice the SWE can't go and report the employer to anyone for breaching e.g. occupational health and safety laws, or any others, because those laws don't exist for the majority of software flaws. At best you have privacy laws like the GDPR or industry-specific ones covering e.g. medical devices...but CrowdStrike isn't meant to run in those environments anyway, see, look at this text buried in the license agreement.