I think what happened to D-Link should be standard. They have to have 10 years of independent security audits.
Are they looking and taking "just here to mark a check box, I don't care if it works or is true...
Or do they take people who will tell them (and they react) what is wrong?
More often then not you see something like this: encryption too weak: me guys, this is too weak!
Answer : it's good enough for this scenario in this network.
And they proceed to mark the box... Encryption existent..
IMO, these issues are rarely down to the people in the trenches, and more to do with a lack of budget or care from management. I would push for independent auditing, with a view towards the auditors ensuring that the team in place is capable of continuing this work.