NCC gets paid to do security audits, and getting paid puts their (very high) professional reputation on the line.

I'll admit I'm biased: I worked a bit with Zooko and Nathan (Wilcox), pre-Zcash, on some other security audits. My experience was that making the client look good is really not a consideration. Phrase your findings neutrally and informatively, yes; but you earn your rep by being as creatively nasty as you can at breaching the system.

Not to argue against evaluating claims skeptically -- just to state my most important disagreement.