The NDA is mutual. It might say 'company x failed our pic-audit, we need help fast'. It guarantees we keep that secret but use that info to find the right match.

Also on the pen test side, we wont't say vendor C put in a $10k bid, you should put one in at $9k. It just means we value trust and privacy, as everyone in the security field should. Testers would also sign an NDA when they take a job, so that they won't leak things they learned in confidence.