Re: Wasn't "But we had to have SMB for our internal shares on the network" the NHS problem?
I think sysadmins don't like to do port scans from outside their network as the can't see the point looking for something they know isn't there.
I'll add one word to the start of your sentance: "incompetent sysadmins"..
(We pay an external organisation to regularly run pentests against us - both internally and externally. And the results are treated seriously.)