The risk is not the quality of the work that the person might do. The risk is that you now have a state-controlled North Korean asset operating inside your security perimeter.
A lot of these are not there to breach your data, they're there to make money and fund the DRPK.
That's why there's no one industry or types of businesses being targeted, it's anywhere they can get hired. If your a high profile target, that's a bonus not the original goal.
The reason that North Korea targets IT roles in particular is precisely because they're the weak link in zero-trust implementations. Someone, somewhere, has the unfettered rights to access the production database, and they're in the IT department.
Zero trust doesn't do anything for you when you give the person a legitimate account with access, which presumably you must do for employees else they can't typically do any work
That's why there's no one industry or types of businesses being targeted, it's anywhere they can get hired. If your a high profile target, that's a bonus not the original goal.