> It doesn't do nothing.

Yeah, it's called regulatory capture.

Treating security as an accounting exercise has never stopped a 0-day. Better software tools and practices have.