>Is their product useless there?

Probably? For instance I doubt an EDR product can detect malware being executed on iOS/Android, because all the apps there are heavily sandboxed and provide no mechanism to do invasive monitoring of everything's that's being run.

>Linux they use ebpf

According to wikipedia it's been ported to windows and on linux you can still load kernel modules which are crashable.