The problem as that these directives and standards are completely beside the point. They do manage a lot of security-relevant stuff, but in the end what’s hacked isn’t the documentation the standards require but the actual code running on the machine.

And there’s pretty little that the standard can do against actual honest bugs and mistakes in the code.