Even for smaller companies, when doing financial audit (required by law in many places) - consultant firms do highly encourage use of “endpoint protection across organization”. So in case of some IT screwup and financial losses, the auditors can say- “Well, they had Industry standard antivirus, so this shouldn’t have happened. Our financial risk assesment was still correct.”