Yup, pretty much. Which makes me wonder what the actual goal is, especially since they've had vulnerability scanning for years iirc