As someone who's worked on obtaining Common Criteria and FIPS certifications, I fully believe security certifications have little to do with security. Especially if you don't carefully read the definition of Security Target therein; that part is very much like the arbitrary process in your ISO 9001 mention.