It depends on how much policy your organization has. If your organization requires AV scanners and other security crapware to be on all instances, how long does that take to install? And perhaps they require that you only use their AMIs, which then must be loaded up with extra software to be usable. And perhaps they require all auth use their special auth service, which takes 5m to sync with. And on and on. I've worked in places where it takes 20m to spin up a usable instance, so we ended up just keeping them on most of the time.
In an ideal world, the policy groups imposing these inefficiencies would get billed for the cost of their policies, but I've only ever seen situations where everyone else pays the cost of their incompetence.
Ah, yeah, we kinda have to work around the fact that the antivirus and scanner stuff keeps installing far after the time the instance is done processing the job.
On the plus side, I actually get actionable notifications from the stuff, so it’s not purely bad for me.
In an ideal world, the policy groups imposing these inefficiencies would get billed for the cost of their policies, but I've only ever seen situations where everyone else pays the cost of their incompetence.