Because most EDR is not designed to catch exploits.