It clearly states in the post mortem that rapid response updates were pushed globally without any say from the customer: https://www.crowdstrike.com/wp-content/uploads/2024/08/Chann...

So in theory if a company like crowstrike were compromised by criminals/disgruntled employee/NSA the impact could not be avoided?

Given the cybersecurity landscape it is not unusual for security software updates to be pushed globally without the option to test or even stagger them. When a potent new vulnerability becomes public knowledge (or semi-insider knowledge) and especially if there's already a PoC available, organizations only have minutes to a few hours before threat actors begin utilizing it.

APTs and organized crime groups have 24/7 staff to weaponize and integrate new vulnerabilities into their workflow as rapidly as possible, or have other contracted other groups to provide this service.