Mostly just curious but why did CS alert on a bad driver only after upgrading to 25H2?

This is mostly a curiosity question rather than like a gotcha question but a host was upgraded to 25H2 and when the machine rebooted Crowdstrike created an alert regarding a driver that was "malicious" but Windows also prompted saying that one of the drivers was expired. The curiosity comes from why didn't Crowdstrike alert that the driver was suspicious prior to 25H2 being installed since the driver has been there for years?