While this likely saved them from the disastrous CrowdStrike outage that had a massive global impact
Exactly none of those endpoint security packages belong on anything safety critical.
Their remote management and monitoring features present single point attack surface, pop the management server and you likely have enough C&C to at least DOS-condition all the clients.
They potential break operations like filesystem access in potentially surprising ways that are difficult or impossible to do good defensive programing and error handling around.
They are only effective if updated frequently which means your are constantly introducing change into what should be a highly controlled environment.
Safety critical stuff if it really has to be networked, and really has to be some COTS os platform, should be isolated with enough layers and very carefully network access control devices/ and lists that allow only very specific communication with the next lower security layer. The OS platforms themselves should be in the most hardened 'FIRST PARTY TOOLS ONLY' configuration possible, ie nothing runs with anything but least privileges, the 'operator' does not have the ability to escalate they are not root/administrator, they can't sudo etc, only a small group of engineers get those credentials. Coding signing requirements turned on etc. Absolutely no automatic updates of any kind, no unnecessary services/daemons running.
What you most definitely do not do, and toss the same GPOs you have the customer service people on them and install clown-strike, or whatever else on them.