Most enterprises these days also run stuff like Crowdstrike (or literally Crowdstrike) on their macOS deployments. Similarly Windows these days is bundled with OS-level antivirus which is sufficient for non-enterprise users.

Not in the security industry, but my take is that basically the desktop OS permissions and security model is wrong for a lot of these devices, but there is no alternative that is suitable or that companies are willing to invest in. Probably many of the highest-profile affected machines (airport terminals, signage, medical systems, etc.) should just resemble a phone/iPad/Chromebook in terms of security/trust, but for historical/cost/practical reasons are Windows PCs with Crowdstrike.