They still have two important moats: (1) expensive hardware tools (even stuff like SATA write blockers are kind of expensive for what they are), spare hard drive collections to swap failed PCBs, etc and (2) the "nobody got fired for hiring us" edge similar to how everyone calls in Crowdstrike/Mandiant after an incident. If a suit-level manager finds out customer data was lost, they are going to want to call in an expert so they can immediately tell the customer they did, not have the same internal team try to figure it out.