The entire system is about abstracting away liability, not keeping things secure. Every framework is like this. The fact that companies are paying auditors to review their own work creates a completely upside down incentive model, and turns it into effectively a rubber stamp. You have to do things horrifically wrong for an auditor to care, and it's not like they're actually going to fail you, they'll just tell you to fix it and give you a generous deadline (or, for frameworks that allow it, do what you described and have it signed off as a known risk).