I have personally been a part of security audits that have found critical vulnerabilities in some of the best-known tech companies on the globe.
Just because there exists a world of auditors who function as rubber stamps does not mean we all do.
Just because there exists a world of auditors who function as rubber stamps does not mean we all do.
That said, the opportunity to do this (scrub reports) is a driving decision behind many companies' choice to work with more permissive firms. If you want a rubber stamp, you can certainly get it, but if you want a true partner who will find and exploit issues you can get that too.
Could you name such a company? This is a perfect opportunity to get to know a good auditor, actually I can't imagine how would one look for a good auditor otherwise.