I know because our apt mirror takes much longer now to sync. That's because the crowdstrike agent is using all the CPU to scan every .deb package.

And they're ar-tar packed, so unless there's a special algorithm to scan for them, nothing will ever be found in them anyway.