If you're objecting to the idea that, having caused a breach, the convicted attacker is now on the hook for securing the application they broke, so that the attack they used is no longer viable, I agree. That is in no way fair.

But that's not what's happening.

Instead, having been breached, and only because they've been breached, the victim is now in a position of needing to assess the extent of the damage done. They can't guess --- at least, not if they're a major corporation --- because continuing to operate when you have reason to believe you've been systemically compromised is unethical and dangerous.

That's the difference between a DF/IR audit and a security audit. A security audit tries to find all your vulnerabilities. A DFIR audit tries to scope the compromise and retain evidence. Of the two, the DFIR audit has a narrower scope and more specific purpose.

But, weirdly, it's also more expensive. There are more application security consultants than there are DFIR auditors, and DFIR auditors are often selected by insurance companies, not by the market.

At any rate: the costs we're talking about Keys having incurred are not a bonanza of free assessment work Trib gets to bill to Keys.