Most (but not all) had some sort of asset management tool and/or antivirus as standard on computers, but nearly all provided exceptions to having that functional/installed.
I, and I expect many developers, likely select companies with IT policies that avoid potentially harming individual productivity.
Abuse of that trust was a fireable offense and someone did get fired for it.
Except all the developers just got permission to install virtual box, and ran another OS inside virtual box that they could and did do whatever they wanted to.
This didn't improve security past not locking down devices, it substantially hurt it, but it was also the only way anything got done.
I work in finance and we get all these audits and questionnaires from regulators, insurers, intermediaries, clients, etc. and many of them are straight out of the 90s.
For example, when we replaced the VPN with a zero trust system, we got a ton of pushback. It didn't matter that the ZT implementation provided stronger guarantees than the VPN ever did as well as doing everything the VPN did. What mattered is that it wasn't called a VPN and they were expecting me to write "Cisco VPN" or similar.
Unfortunately, developers having admin access on their machines triggers so many red flags in these processes. Doesn't matter if you install a load of auditing and remote attestation stuff, admin access is instant ticket to bureaucratic hell.