In my mind, that is because the protection is what they're paid bags of cash to do.

If Crowdstrike was a charity I might find myself agreeable on your description of fair in favor of Crowdstrike.

I mean, just for _basic_ audits, you would hope to have that. If ransomeware can destroy your entire facility, than an angry insider can do much worse.