Yeah, ISO 27001 is paper pushing, but TISAX audits can be pretty painful and detailed (I've been tangentially involved in one, but can't say more). I think insurances are the player to watch the most - they have actual leverage on their customers and really really want to avoid having to pay out for claims, so their demands start to get more and more intrusive, to the point where they can and do collide with stuff like employment laws (e.g. monitor all employee communications through a mandatory proxy service, even if the device is not on-prem).