The most secure company is, of course, the company that doesn't exist. Bankrupting your org is certainly the most effective way to keep it secure.

Yes, their role is defense, but not insofar as to remove the profitability of the organization. In several orgs now I've seen the legal team blow contracts and the security team break the product and the IT team break development in the name of performing their role "correctly".

Brainless box checking is not part of defense, you must be willing to critically think about how to fit your role to your product or organization's profit motive.