You in fact have no idea how "innocuous" the Drata agent is. You know only what Drata tells you.

It would be grossly irresponsible for a contractor to rely on one client's assurances about what a third party told them its software did, and expose other clients' data to errors or abuse by that third party. Or their own personal data, for that matter.