you must have never worked in a corporate or enterprise environment.

I'm a security engineer and we work with this stuff daily. In fact most enterprise endpoint devices (laptops, phones, desktops) have not one but several security software by different vendors for different purposes.

Antivirus, firewall, proxy, VPN, monitoring, ....

We have a small desktop farm environment and a handful of devs with Linux laptops, they all have defender installed.

Most insurances I've worked with require those. This is not a country thing, but a company thing. My current business insurance requires them

By law, there is nothing thar REQUIRES it per se, but there is a set of rules and regulations where installing it is one way to fulfil the requirements. Especially NIS2 requires "appropriate cybersecurity risk-management measures", so having a free anti-virus run on the system is one way to implement it, amongst other measures of course.

and there wasn’t an anti-virus solution

I'm not saying every company follows them. I'm just saying if something happens and they discover you're not following certain regulations, you are in the big shitters and will be very likely held liable.

Not caring about security is fine as long as nothing happens.