A malware research team can label ten thousand binary samples because a human analyst, or a sandboxing service, can examine each one and decide. No security team can label every network flow crossing a large enterprise network every second; there are simply too many, and most of them are mundane. This is why intrusion detection leans so heavily on unsupervised learning: instead of asking "does this match a known bad label," it asks "does this resemble the traffic I have already seen, or does it stand apart?"
ML concept: Clustering versus Anomaly Detection
These are related but distinct goals. Clustering groups similar points together and describes the structure of the whole dataset ("there are three broad traffic patterns on this network"). Anomaly detection asks a narrower question about each point: how unusual is this one, relative to everything else? A point can be the single member of its own tiny cluster and still be the exact anomaly a clustering algorithm is meant to surface.
Key takeaway
Unit 2 assumed labelled data: this file is malware, that one is not. Most security data arrives with no labels at all. This unit learns to find structure and outliers without labels, using clustering, dimensionality reduction, and anomaly detection, and applies all three to intrusion detection.