Allowlisting is also one of the best security practices you can implement, because allowlisting significantly reduces the problem space of executables you have to consider (and dangerous executables, if found, can be removed from the allowlist). There's always a chance that a piece of malware which somehow breaks the sandboxing and isolation can find its way onto someone's device; allowlisting greatly mitigates this possibility.

Endpoint security is everyone's problem now, because everyone has one or more always-connected devices. The future of computing is a signed, remotely attested path from power-on to user application code, all checked against an allowlist of approved binaries. For most, this will be a good thing.