Penetration testing / security consultancy falls into this trap too. All the downsides are present.

It is weird, though maybe not so weird if you think about it for a few minutes, how closely aligned law and offensive security are with business practices.

One of the things I want to do with my consulting business going forward is to explicitly depart from this model. We will see if the market accepts it or not.