I have met CSO's who are similarly confused about what OWASP Top 10 actually means.
To be fair, OWASP does publish some excellent frameworks focused on enhancing broad-based organizational security posture, like their SAMM (Software Assurance Maturity Model) project:
Re:Unplugged Phone Mysteries
by TheMaskedCoder on Thursday July 28, 2022 @06:07PM
(#32270649)
How to prove your product is secure:
1. Pay for a minimal test.
2. Minimal test does not find anything.
3. Tada! Your product is secure. Put the report on your website!
1. They are selling a "secure" phone, but it only reviews their mobile apps.
2. They are testing their mobile apps according to the Open Web Application Security Project (OWASP) TOP 10. They are mobile apps, not web apps.
3. OWASP TOP 10 is advertised by OWASP as the "first step towards changing the software development culture within your organization into one that produces more secure code". Conformance does not mean security, it means the first step toward security.
It is like applying to a professorship in physics and your entire resume is that you once got a gold star on a elementary school arithmetic exam.