Not sure I agree. It might sound like theater if you expect it to solve your security issues. But it is extremely good at finding undocumented or broken processes - these processes tend to hide the biggest offenders.

I kinda agree, I won't pretend it's otherwise. But I do believe, that particularly now, it's important to keep the bare minimum. And some aspects of managing compliance are kinda useful (like checking that you have a lot of backups, but no decryption key).