Probably? For instance I doubt an EDR product can detect malware being executed on iOS/Android, because all the apps there are heavily sandboxed and provide no mechanism to do invasive monitoring of everything's that's being run.

>Linux they use ebpf

According to wikipedia it's been ported to windows and on linux you can still load kernel modules which are crashable.

On Linux, they apparently had done the same thing and caused a bunch of Linux systems to crash[1].

[1]: https://www.neowin.net/news/crowdstrike-broke-debian-and-roc...