Security is frequently only as strong as the weakest link. If you’re an adversary, would you spend more time on an org’a poor security practices (pentagon failing audits) or a more difficult software vendor?

The audits in question are financial. There’s no doubt some overlap with security – e.g. failing to replace out of date software due to financial constraints exposes them to risk – but it’s not a simple relationship.