true, especially corporate SecOps, it is theatre, mere tickboxery to defer liability.

Most security professionals I've met in my career border on being non-technical, there are of course security researchers and a whole arcane and academic field that exists well beneath the surface but it is so far removed from the every-day.