Most enterprises these days also run stuff like Crowdstrike (or literally Crowdstrike) on their macOS deployments. Similarly Windows these days is bundled with

Most enterprises these days also run stuff like Crowdstrike (or literally Crowdstrike) on their macOS deployments. Similarly Windows these days is bundled with OS-level antivirus which is sufficient for non-enterprise users. Not in the security industry, but my take is that basically the desktop OS permissions and security model is wrong for a lot of these devices, but there is no alternative that is suitable or that companies are willing to invest in. Probably many of the highest-profile affected machines (airport terminals, signage, medical systems, etc.) should just resemble a phone/iPad/Chromebook in terms of security/trust, but for historical/cost/practical reasons are Windows PCs with Crowdstrike.