It's the same in edutech.  Aside from SOC2, my team spends an outsized amount of time on WCAG 2.2 compliance. Not to mention all the PII stuff.  

 A not-so-hidden, massive tax on multiple industries, with utterly dubious positive outcomes.