The only exception was at one company, an auditor flagged that weren't in compliance with "antivirus software is installed on all storage servers," and as they defined it, that would have included our Docker image repositories and S3 buckets. They gave us some suggestions on how we could do this, for example a Lambda-based solution that would scan all files uploaded to S3. We just said "no" and they dropped it.
The only “huh?” Moment I remember was when they asked me whether we used MFA, and then I proceeded to talk about how we have TOTP, WebAuthn, etc for our “2FA” as I happened to refer to it, and after talking for a minute about it, the auditor said, “just want to clarify, do you have any MFA configured”… at that point I realized how much they were just blindly marking checkboxes. So I just said “yes we do.”
The regulatory controls themselves are mostly reasonable, but seeing the competency and rigor (lack thereof) of the auditors was completely demotivating.