Re: We take the protection of our customers’ data very seriously.
No-one in their right mind would take a CTO job if this was the case.
You mean, nobody who doesn't know anything about security, how to enforce it and check that subordinates are indeed implementing said security would take the job.
And that's exactly the purpose.
Someone who cannot ensure that subordinates are doing what they're supposed to be doing should not be in any position of power. C-level management requires a person to have leadership skills, not being best golf-buddies with members of the board.