Funny enough, this thought process shows a failure to understand process and internal influencing. Quite often, the things found by a basic pen-test are known internally. Research will reveal long, boring discussions that end with someone like Bill dismissing things as not important and the risk acceptable.
What the paid-for report does it makes the risk visible, documented, and something the company may have to show to customers or partners. Now it's gone from something that can be shrugged off to something expensive and embarrassing. Bill has to explain why his opinion should matter more than those of the biggest customers. Now it's something that is much easier to prioritize.
Big management often doesn't value unpleasant or critical feedback from below. Once it's advice that's been paid for, its value jumps. After all, if you're not going to listen then why did the company pay the big bucks for it?