I think it's more apt to say they lack the expertise to second guess the established best practices. There's also the question of indemnity. In case of a breach

I think it's more apt to say they lack the expertise to second guess the established best practices. There's also the question of indemnity. In case of a breach, they need to prove they followed established best practice in writing.