In practice, CrowdStrike very likely tests Falcon on various hardware as parts of their tests before shipping updates on it, as it’s used by a huge amount of enterprises; and a fuckup like that would mess the trust they’ve built with those enterprises. Enterprises are trusting them to run ring 0 code on their computer, so they can have a malware-less experience after all.