> The insurance companies that insure companies against ransomware insist on putting host based security systems onto every machine or they won't cover losses.

This is part of the problem too. These insurance/audit companies need to be made liable for the damage they themselves cause when they require insecure attack vectors (like Crowdstrike) to be installed on machines.