One issue is that the signal users want isn't the signal compliance gives. Users want to know if a product is safe & secure. Compliance tells them that it's following a given standard. The latter does not imply the former, it's "useless" to them because of the mismatch.