Except when companies have a breach, they mostly just get a slap on the wrist and everyone moves on. It doesn't tend to materially affect the success of the company except in very rare cases.

Those will be a huge part of the actual due diligence process.

I've been on the receiving end of a very intrusive one, and it was essentially an arduous multi-week long audit. (IIRC four weeks of evidence collection, followed by ~8 days of intensive interviews.) With the main difference to audits being that on the requesting side, there was someone who actually understood how security, human processes and business all intersect.

7 audits in one year was a bit much.