Yeah it's a 100% checkbox exercise explicitly designed to only satisfy the letter of the law.

Unfortunately critical infrastructure providers flock to that, though there are some exceptions.