I spent some time on STIG website out of curiosity. There seem to be down-to-earth practical requirements but only for Windows, cf. https://public.cyber.mil/stigs/gpo/

Why does it justify running antiviri on Linux is beyond my understanding.

Weak, impotent, speechless IT personnel that can not face off incompetence?