I don't think it's nefarious, but the end result leads to a pretty frustrating experience by anybody needing actual security work. (and without the organizational deep pockets to obtain SOC 2 attestation)