In short, if they are a company and are not 100% secure and they say they are then they are committing fraud. The person doing the testing is providing the evidence for a legal case and no amount of legal threats change that.