I could offer you protection, free of charge, against dragon attacks, and that does not make it a scam.
I am becoming allergic to http:// URLs.
You pay the fire department with the taxes, not when you call them.
You can tell when something is security theater because you need some absurdly specific situation in order for it to be useful.
Honest Achmed promises to abide by these practices. If he's found not to abide by them, he'll claim it was a one-off slip-up in procedures and that policies have been changed to ensure that it doesn't happen again. If it does happen again, he'll blame it on one of his uncles or maybe his cousin, who still owes him some money for getting the car fixed.