Implicit in this article is the idea that security posturing is a zero-sum game for many companies on the dimensions of both software complexity and time.

Adding full disk encryption takes time from other projects and makes the system more complex. That equation needs to pay out. In all likelihood, the reason your data is going to get stolen is a privilege escalation in your app code or a bad actor on your team. Rogue AWS employee swiping your particular hard drive in us-east-1 is way down the list. Full disk encryption does nothing for the first two vectors.

I think compliance programs are oriented around pushing companies into complex/expensive system designs thinking that is a proxy for a secure system.