I worked in software certification under Common Criteria, and while I do know that it creates a lot of work, there were cases where security has been improved measurably - in the hardware department, it even happened that a developer / manufacturer had a breach that affected almost the whole company really badly (design files etc stolen by a probably state sponsored attacker), but not the CC certified part because the attackers used a vector of attack that was caught there and rectified.
It seemingly was not fixed everywhere for whatever reason… but it’s not that CC certification is just some academic exercise that gives you nothing but a lot of work.
Is it the right approach for every product? Probably not because of the huge overhead power certified version. But for important pillars of a security model, it makes sense in my opinion.
Though it needs to be said that the scheme under which I certified is very thorough and strict, so YMMV.
At this point, Prime doesn’t make sense if you want to save on shipping. It made sense because it included a lot of good stuff (video before ads, some music, shipping, games) but just for shipping, there were better options.
I basically overpaid but didn’t care out of convenience - partner sometimes watched prime, I ordered occasionally, played some included games. But the changes to video were so shady that I cancelled it.