Your comment resonates with me but I'm not sure I fully understand it: "compliance transfers risk out of the project and onto the standard/model": If I choose to be compliant to a standard, some of the risks are mitigated, not transferred; some risks I have that are not covered by the standard are not mitigated or transferred, but still unknown, because I chose not to look into the threats (but just comply with some standard). So how does it transfer risk out of a project?

"A business PM won't problematize those things because it will demand a solution that gets in their critical path. The best they can do is manage it": If you identify a risk you can still choose to accept it and do nothing to mitigate it. So why does it demand a solution?

"you've reduced the flexibility of the business to manage that risk": Why? Again, risk identification does not automatically mean risk mitigation. If you're aware of a risk you may choose to detect problems instead of prevent them from happening. How else would you be able to manage risk if you are not even aware of it?

Maybe your comment is related to something I have experienced. I often think about a theoretical situation related to the movie the Matrix. Suppose there exists a complete risk analysis that provides insight into every aspect of risk for a company. By taking the red pill responsible management would instantly see all these risks, but it cannot be "unseen", so they would have to act to reduce them to acceptable levels (taking away resources that would otherwise be devoted to business functionality). Would they take the red pill or the blue pill? I think most managers would choose to stay ignorant.

[edit: wording]