What a paradox. You are blessed with innocence about the ways of low-rent security auditors, but poisoned with cynicism toward their victims.

I dunno, I also feel it's fake. When compare the experience dealing with bullshitters aginst the one in the original post, it has a different feel. The post is too "internet creative writing" in tone an substance: where every argument, counter-argument, rebuttal and retort perfectly mesh to create the ideal shower-argument-esque narrative. Particularly as it feels like the same person is writing both sides.

In real-life you either cut it off politely to save your own time, or it would just descend into a mudfight.

If it makes you feel better I had a similar, but not so exciting, situation happen to me in the past. So it's not entirely outside the realm of shit that happens. What does seem super fake is the doubling down, having it an SOP/SSP, and the tripling down without some crazy amount of escalating.

For example my experience went sort of like this:

Low Rent Auditor: Please supply a list of username and passwords for xyz systems.

Me(ccing boss and internal secops): No. Why are you asking me for that? <Links to internal SOPs, guidelines, basic common sense, etc>.

Low Rent Auditor: We need this for x box on y form. <attached>

Me (ccing their Sr. Auditor): That's not what that is asking for. Here's a copy of the PAM config. <attached>

FIN

Meanwhile my issue with it is that the story got so popular online, given it feels like a normal day with most security auditors. I have to have worked with dozens of guys just like this. The only thing consistent is that they are the ones being listened to.