They initially hired me to do "network security" work. Another similar email-then-bill situation is me responding to them telling them why I won't, under any circumstances, figure out who wrote a Glassdoor review.

A lot of it is about setting boundaries with the client. If I have a conversation with you a handful of times to remove password from a whiteboard and you don't do it, that's a big deal and would professionally impact me if something bad happened. Cause like, your client's clients includes Coinbase. Like another person commented -- I really should have just dropped them as a client because the professional risk was too high.