Literally this. For the most part this part of the industry is a fraud. They just run scanning tools and hand out pdf reports. Eventually some dev or ops team will say the reasons why they currently can’t comply and the cycle will start again in 6 months.

They literally do nothing and don’t even have to help integrate the security fixes. They just give reports. A sweet gig if you can get it. People rarely want to cut “security.”