Then a handful of years later they forget it all and repeat…

They don’t forget, they never learned in the first place. In their minds the original engineers messed up, and that’s why there was a vulnerability, or a missing feature. “We need a quick and cheap vendor to fix the mistakes of our awful engineering team that we laid off a year ago”.

The requirements of other companies that you follow xyz audits to do business with them etc(which can be a good thing, it’s just very costly to a business).

I secretly enjoyed getting on the phone (one-on-one) to explain this one to leaders.

“Previous decisions have made us a complete laughing stock among our peers. How would you like me to write that up for the audit report? Okay. I’ll use my judgement.”