Quite a lot of years ago, when I was much younger (and incredibly naive about "consultants") and …

There is a large market for useless security work from companies that need to demonstrate that some kind of security activity has taken place but don't particularly care about security as an "end". In these situations everyone is just "going through the motions", the PM who hired them, the pentesters, the devs who dutifully put pointless findings in the backlog, compliance people tracking stuff in their register... The only thing worse is not having a process at all.

I've worked in various consulting roles, and one thing that's always been true is the "rank and file" don't like you and think they know better, can do better, and already know or have thought of everything you do. They miss that you're hired by leadrship, for other reasons (see my other post in the thread). I'd actually be worried (and it's happened) when the line employees like you as an external consultant and think you're adding value. It means you're engaging at the wrong level and probably not getting at the root of what you're there to address.