For many companies it's just a checkbox towards compliance of some sort. You can argue and be right until you're blue in the face, but in the end it's the approval of, and certification by external auditors that matter.
As someone who works in IT, it is almost never up to IT what goes onto the Mac device. It's usually a compliance/legal ask, good luck explaining to a customer why you don't have anti-virus.
Customer wants to see: Yes, Company X has Y anti-virus product on all devices.
Have seen this where I am since we have grown from a small company to a medium sized one. Spyware, endpoint protection which crippled sudo, can't update tools that we have used for years.