[AMerrit]

I work at a similar cybersecurity company and I can almost guarantee this is the case. Company policy will be to put an AV on everything, and the CSO/procurement always prefer a one size fits all solution so they only have to deal with one vendor. How well it works on Linux is secondary to the fact that it makes it easy for them to hit all the checkboxes in compliance reports.