It's always been one.

Every single technical auditor I've dealt with has been majorly incompetent and wanted to do things that would decrease security. And these were not some cheap bottom of the barrel companies but the big "industry leaders".

Never forget https://serverfault.com/questions/293217/our-security-audito...

Oh my, that is so funny and terrifying, but also exactly what my first expectation is for a consultancy firm