Either they bend to the folks paying the bills, or they flag a zillion, generally known to engineers, issues.
If you really want to make you security audit useless, hand the auditors C code. They will stare at you as though you just handed them the head of a small child.
Just because there exists a world of auditors who function as rubber stamps does not mean we all do.
That said, the opportunity to do this (scrub reports) is a driving decision behind many companies' choice to work with more permissive firms. If you want a rubber stamp, you can certainly get it, but if you want a true partner who will find and exploit issues you can get that too.
Could you name such a company? This is a perfect opportunity to get to know a good auditor, actually I can't imagine how would one look for a good auditor otherwise.