SOX requires code review by a second party. If the reviews are automated, the development process isn't in compliance and that can get expensive in a hurry.
Sort of; it's like the itemizer systems at airport security. They're entirely theater (in the sense of "for show") but that show is itself important in that it makes entire categories of attacks significantly less feasible.
Sort of like how simply having a uniformed police officer on a street corner reduces street crime significantly even if the officer never interacts with anyone.