To highlight the lack of binary obfuscation as a threat (albeit a "low-severity" one) is absurd. Kerckhoff's principle [1] applies. The report doesn't call lac

To highlight the lack of binary obfuscation as a threat (albeit a "low-severity" one) is absurd. Kerckhoff's principle [1] applies. The report doesn't call lack of binary obfuscation a "low-severity" threat. They mention it as an informational finding. Informational is not Low severity and the rest of your rant seems based on this misunderstanding. You're not wrong in the general case about pentest firms having an incentive to make severity up; you're just wrong about that applying to this particular case.