It's 100% a racket. Your code could have been 10x worse and still passed, I doubt the auditors even looked at the code. It's a legal box-checking exercise, there really isn't much of an actual review besides the documentation. But my god is there a lot of documentation and paperwork.