I've worked with about eight or nine. Two of them are jaw drops in horror. A bunch are "err, what?", but get the job done vaguely competently if in a very procedural fashion. Quite often it's totally nontechnical people with backgrounds in finance/filing who do the assessment. Finally, there are two outfits we've worked with that we liked - one well enough to come audit us.

Oh, also, the big automated platforms like SM and TW are pretty poor.

The way it's set up right now, if you're lucky enough to be deemed a QSA by the PCI council, congratulations, you are now legally welcome to blackmail and extort. Zilch oversight, it's the Wild West, and snake oil salesmen abound.

The OP reported the auditor with the appropriate authorities and hopefully they'll revoke their certification.

Alternatively, I'd report the auditor to the police for attempting to acquire personal user data, a clear violation of data protection acts and user privacy.

Naming and shaming is also going to paint a big target on that company's head, since, you know, they collect plaintext data n' stuff

I suggest being careful with UK libel laws here. I am not a lawyer.