They don't want to compromise the endpoint. They want to ensure they have a record of all communications to and from the endpoint.
The assumptions that TLS 1.3 is based around are in direct conflict with the requirements of the secure environment they operate in.
This isn't some evil thing... a cryptographic protocol is a part of a trusted system, and whether it is appropriate for a particular context has to do with the design of the trusted system.