It's the same with ISO27001. A bad actor can always weasel their way through.