Some cyber insurers are already doing this. I know at least one that scans the company network when quoting and will decline applicants who have open RDP detected on their network for example.