I think this example is why the appearance of a conflict of interest should be the standard for navigating ethical concerns.

If a guy owns a company, I don't doubt that he believes it's the best at what they do. The one thing most CEOs I've met have in common is they ridiculously overestimate how great their companies are. This guy probably genuinely believed his security company was the best choice. It's "not invented here" on the scale of companies instead of git repos.