Same thing with selling software to the government. "Is the software secure" is far less important to those customers than "does it pass the scan".