There's a difference in stakes and impact and intent: the client firm is actively interested in finding security holes and the outcome of a negative security report does not (usually) directly affect the continuing operations of the business or impact on the personal reputations of the business owners their ability to conduct business, or how moral they're perceived by society.
A negative report here would be a devastating blow on Linus himself, his business is built around him and relies on audiences trusting him, it would also open up the door for legal action that could result in massive monetary damages and fines.
I've had "independent" valuations and audits. I've seen how these firms work - and it's not independent. They obey the people that pay them or they don't get any work in the future from anyone else "that firm destroyed my business".
The most suspect aspect of the report is that they found nothing negative, everything was perfect. This on its face doesn't ring true for any business I've ever seen, as well as how they responded to the accusations and how many people came out to accuse them.