Ask HN: Is SoC{1,2} a racket?

I've worked at several companies that were going through SOC1 or SOC2 compliance. My main impression of it is that after a long period of talking about compliance at every standup, at the end, almost nothing is observably different, yet now the product is SOC2 certified.

What even is this certification about? Does it provide any actual security, or is it just a scheme to make money for auditors? Would be interested to hear HN's take on it.