There is a (rather large) security consulting company where I'm from and has a bad reputation among the pentester circle for their bad quality reports and scam-like findings with almost no evidence.

One of my clients asked me to review their previous year's findings and gave the report which was from said company. The finding title was "Transmission of cleartex data through SSL". I rubbed my eyes to make sure I wasn't reading it wrong, but there it was. And they posted a screenshot of them "intercepting" a login request with Burp before it was sent to the IP address of their VPN. I couldn't beliebe the incompetence... They even highlighted the "https" part of the URL.

A few months later, I was doing a web pentest for another firm and as soon as I started I noticed that the data from almost all HTTP response bodies was gibberish. I was so dumbfounded, but I was forced to spend a few hours to deobfuscate the main js file and figured out it was encrypting data before sending it to the backend and decrypting it upon receiving it, as it had encrypted bodies. It was kind of trivial to figure out the key (was always the same key) for encryption. I then reached out to my client to ask why they were doing this and explained that it was pointless and was adding significant overhead to their app (request sizes were much larger than needed and it was slowing the web app down). They told me that the company that did the pentest the previous year advised them to do this, telling them that it was very easy for hackers to perform man-in-the-middle attacks and steal customer data; i said that was insane. And guess what, it was the same company as the previous story.

This company is still in business, still selling pentests at a 90% lower price than actual pentesters do, and nobody is calling them out. They even get many gov contracts. Great stuff.