Complicate requirement are kind of out of date. They keep adding requirements to them but then don’t often take them away. So if a requiment made sense 20 years ago it’s still there even though there are better strategies to protect your environment.

You could skip a requiment if you can establish a compensatinh control and show that the threat the requirements is intended to address is addressed. For example skipping antivirus by reimagining the devices every morning, this is an absurd example but would work.

No IT Auditor ever tests this, the just ask and if you say yes they move on. To actually test this you would have to statically sample a random sample of devices and confirm the antivirus is installed.

Instead that auditors are going to ask for a list off devices enrolled in the antivirus and a list of all devices (if the company even has an asset inventory) and see if they look right. But, most like the asset list will come from the antivirus enrollment and it won’t matter.