My question is: If you talked to a customer and they said "we have around 200 hosts not controlled by us running code and reading data from our systems, is that a problem?" would you say "no, that is totally fine"?

It doesn't need to be perfect, but I think that for a security firm we should be able to do better.