I think you just have a wrong perception of what your SIEM does/is supposed to do, or how it operates.
The SIEM most likely raises alerts on installation attempts of "bad software" via the OS' audit logs or similar methods. Since personal laptops are no company-managed clients, they most likely do not submit those audit logs to the SIEM, or communicate in other ways with it. Hence they do not trigger an alert. Your SIEM apparently does not check if the download/traffic is malicious, it only checks if employees try to install any software on company equipment, and reports installation attempts of unapproved/"bad" software.
So in short: No, your SIEM did not report false negatives. Your SIEM is just doing its job within its capabilities.