If I had to guess it's that very few people use it for actual security guarantees and most use it just to be able to fill out the questionnaire or compliance box saying "we do this".