Ok, suppose you're right.

Why are they only doing it for macs then?

It may depend a bit on your organization but I bet most folks using an EDR solution can tell you that Macs are probably very low on the list when it comes to malware. You can guess which OS you will spend time on every day ...

So because macs are not the targets of malware ... we're locking them down tighter than any other system?

No, see, they're leveling the playing field by storing all secrets they find on macs in plaintext

I don't think this is limited to just Macs based on my experience with the tool. It also sends command line arguments for processes which sometimes contain secrets. The client can see everything and run commands on the endpoints. What isn't sent automatically can be collected for review as needed.

It does redact secrets passed as command line arguments. This is what makes it so inconsistent. It does recognize a GitHub token as an argument and blanks it out before sending it. But then it doesn’t do that if the GitHub token appears in an env var.

They do not need to take the data off the computer to do that

Malware can hide in the frame buffer at modern resolutions. They could keep a full copy of it and each frame transition too.