I can relate to the author. Worked for now acquired payment gateway that was for PCI compliance level 1 (over 6 million transactions a year). Getting upset over outdated practices by either the company or the security company testing our software was regular.