Some EDRs do stuff like adding russian keyboard layout as an alternative, which stops a fair share of 'malware as service' type stealers.