A certificate on the wall tells you a box was ticked on a date. It doesn't tell you you're secure today.
Certifications are useful. They prove a standard was met, assessed by someone independent, at a point in time. As a baseline and a common language between buyer and supplier, they earn their place.
The trouble starts when the certificate becomes the goal instead of the evidence. A framework attests that controls existed when the auditor looked. It says nothing about the Tuesday three months later when a change went in unreviewed, an exception quietly became permanent, or a control that was designed beautifully was never actually operated. Certified is a photograph. Security is the film, and the film keeps rolling after the auditor leaves.
You see it in the questionnaire that asks "are you certified" and stops there, satisfied. The certificate answers a question about process and paperwork. Whether the organisation is genuinely hard to compromise is a different question, and the two correlate far less neatly than anyone would like.
This isn't an argument against certification. It's an argument against mistaking it for the thing it points at. The badge is a reasonable place to start a conversation. It's a poor place to end one.
Certified and secure overlap. They are not the same word, and the gap between them is where the incidents happen.