2. Consultancies hire those infosec staff.
3. Companies without infosec staff accumulate security debt until they're owned.
4. Companies pay significantly to consultancies to get their stuff unfucked.
5. Companies start opening high-paying infosec positions to lure infosec staff away from consultancies.
6. Infosec gets tired of consulting bullshit, migrates back to companies.
7. Repeat.