Barracuda wrongly thought it drove 0-day hackers out of customers’ networks

27001 doesn’t actually explicitly dictate anything other than the structure and operation of the ISMS itself. The selection of appropriate security controls to implement is made on the basis of a risk assessment, and although the standard security controls which you are compelled to consider are explicitly listed in appendix A, the actual fine grained implementation of them is not prescribed at all.

There’s nothing stopping you implementing something better than the now slightly outdated recommendations/best practice for those controls found in 27002. It is guidance only, and if you have good reason to implement a control in a different way, or to not implement a control that is listed but instead treat a risk with an entirely different control you are free to do that.

That’s not to say that 27001 doesn’t have other flaws, and that it isn’t sold/understood as being something it’s not in a problematic way.

I have highlighted numerous security flaws in my organization — e.g., forced password changes every 60 days, resulting in many employees using simple passwords — which I've been told were the result of certifications or regulations.

It seems like a quintessential example of "the road to hell is paved with good intentions". Either the prescribed solutions are bad, or the drive to check off boxes in an audit results in shallow implementations that appear to do something but don't actually.