Unrelated to SSO, I’m involved in audits that regularly seek changes which don’t improve safety or security but which often help the bottom line of big providers.

If you want a product to succeed without natural growth, get an an auditor to require it.

It’s selling your soul and those being audited will hate you, but it’s very lucrative.