>So why does it not stop at some point...
It's up to you to set an "exit" for an Ongoing Policy. Jamf will only do what you want it to do if you set a Once per Computer frequency with auto-retry on failure enabled. Ongoing Policies have no logic built in for exiting what amounts to an infinite loop. Every check in, it will run. That's all Ongoing means. Not "every check in, it will run, until some other state is detected or some other thing occurs". You have to instruct Jamf to execute on that logic using additional Policies.
I'd recommend splitting larger software install Policies into two separate Policies, one to download the package (Cache), and one to install it (Install Cached). That way, you could theoretically repeat the installation over and over again without wasting any bandwidth. You then need to perform some Smart Group magic to have successful installations move the Mac out of scope once it's done, either a "Application Title LIKE Microsoft Defender" (make sure you update inventory in the Install Cached Policy), or if you really wanted to be sure, an Extension Attribute that calls the `mdatp` command line utility and does a health check, and then base your Smart Group scopes on that.
