Totally agree. But the thing is that costs money and the real desire is to tick the compliance check list at the lowest cost. So they throw out some software assurance tech, force staff through a click through phishing training program once a year and low ball ISO 27001 and SOC 2 certs.

Ass covered. Security and defence in depth? Hell no. They can employ the apologetics department dung beetles to roll that turd away quickly after the fact.