In every org I've sat down with the head to explain those risks, I can see how it can be made priority and budget.
These operators have no incentive to invest in proper skills. So they don't. They can charge almost anything they like. And sure enough, they do.
In an industry with such massive vendor lock-ins and regulatory capture regimes, organisationally you get to shovel a lot of money for sub-par pentests. The appetite to have yet another one, even from a known-good and reasonably priced provider, is quite hard to come by. After all, these approved providers will REFUSE to even look at a third-party pentest report, let alone let one guide their own testing.
So in aggregate the existence of these approved providers and their level of competence degrades the security posture of entire business domains.
Macchiavelli would have been proud.
Edit: Followup - here is a primer method. The exact method differs if you are talking with leaders, or middle management, or space occupiers. (Leaders as in intelligent, aggressive forward thinkers). You have to make it personal, and show them how the thing that they care most about (eg: career, personal security, promotion, or liability exposure) is at risk; which now-a-days is a true statement.
That is my experience, it may not be others.