That claim needs to be annually tested and verified by independent blue and red teams written up in an official report that measures overall org. productivity as claimed and in actual reality.
What you’re saying makes 110% meritocratic sense, but there’s no way this would ever fly in a penny-pinching enterprise environment. There’s a reason that enterprise sales/support is a gigantic business constantly competing to win contracts.
Nobody in those old style companies are ever evaluating tech on it's merits.
There's always better solutions, sometimes even much cheaper in some categories but they really want the stamps.
If you can demonstrate all the compliance, that's an insurance when something happens, regardless of the actual security value it provides which is rarely evaluated anyways.
Companies working this way really aren't tech companies and they don't behave as such.