A control can only catch what it can see.

Most controls sit downstream of the device, so any AI use that never takes an approved path stays invisible to them. That's what people mean by shadow AI. Where a control sits decides what it can catch, so put it on the device itself and you catch what everything downstream misses.