I worked at a place which got ISO27001 yet had its proprietary source code available unauthenticated from an old CVS server, including over HTTP. You just needed to connect to the wifi or plug in any Ethernet cable into any device. The company just did the magic “accept the risk” and moved on. Anecdotal but I can’t help but feel it would be common for other orgs which are bad at security getting certified anyway. https://youtube.com/watch?v=9IG3zqvUqJY