Because 99% of “cybersecurity folks” that I have dealt with in the past were incompetent bureaucrats or (worse) consultants who had zero clue on how to actually

Because 99% of “cybersecurity folks” that I have dealt with in the past were incompetent bureaucrats or (worse) consultants who had zero clue on how to actually make systems secure. All they did was to email checklists full of demands for specific tech or protocols to be used that either was completely unnecessary, actually wouldn’t work for our project, had publicly known security issues, and/or would not make the system more secure. They almost always had no clue when I asked them for the threat model they were basing their demands on. Don’t get me wrong. I am sure that there are competent “cybersecurity folks” out there. I just haven’t met a single one in my 30+ years career. YMMV of course.