Why would anyone get fired, explicit approval and imppicit incompetence should be handled differently. If pentests get people fired, no one wants a pentest. Refusing to accept and resolve pentest results can be fireable but a pentest is suppose to help you improve what you have already.

Like many orgs that don't know any better, our CFO thought because he was good at excel that he was qualified to direct IT.

That is no longer the case. To answer your question though, you know how hard it is to fire a CFO? Let me know if you have any tips.

The way you phrase the question is odd/misleading.

GP wrote that he replaced the previous CTO.

Before firing the vendor, the responsible party on their side had already left the role.