This does not seem like a standard way to conduct business to me by any stretch of the imagination, though I don't work in cybersecurity. Perhaps that community just has lower standards to which people and organizations are held. Would not be surprised. The things I've heard from that corner of the industry....