The number of breaches would have to be honestly reported for that idea to work. None of the security firms would want to do that; least of all the lowest quartile of them.
and why does this idea work for accounting audits, but not for security? As long as regulations for companies exist, they would necessarily follow it, and this would lead to reporting of security breaches just like companies would have to report their financials honestly.
The difference with accounting is that, relatively speaking and certainly within this context, few businesses are cash businesses. Your bank is keeping at least a basic audit log of money coming in and out of the corporate bank account. Your payment processor is keeping at least a basic audit log of who paid you and how much. You won't make your auditors happy if they're the only documents you have, but they're at least something to be handed over in an audit that pretty much every software business will have. Cybersecurity? By default, nothing is collected.
So if you have no logging and such, you will have already failed regulatory reporting standards - just like you would fail an accounting audit if you have no paper trail of where your money went!