Most insurances I've worked with require those. This is not a country thing, but a company thing. My current business insurance requires them

By law, there is nothing thar REQUIRES it per se, but there is a set of rules and regulations where installing it is one way to fulfil the requirements. Especially NIS2 requires "appropriate cybersecurity risk-management measures", so having a free anti-virus run on the system is one way to implement it, amongst other measures of course.

and there wasn’t an anti-virus solution

I'm not saying every company follows them. I'm just saying if something happens and they discover you're not following certain regulations, you are in the big shitters and will be very likely held liable.

Not caring about security is fine as long as nothing happens.