Because, let's be honest, most "security consultants" are people who couldn't make it as sysadmins, and they've no idea what they're doing.