If you've watched any auditing on YouTube, you know that neither the SIA nor any of the major or minor security agencies in the UK are able to communicate even the most basic tenets of UK law to their members and staff. Auditors embarrass these companies tens of times per day at this point for the whole world to see, and it could all end with a simple e-mail communication or maybe a one-day course. Do they do it? Either they don't, or their staff are too thick or lacking in the comprehension of the English language to take it in.
The truth is that as long as the security industry is the go-to career for knuckle-dragging meat-heads with nothing going on between the eyes, and some of the lowest quality migrants that make it into the UK, nothing is going to change on this issue or any security agency issue in general.
And never mind medical cannabis to be honest, the real scale of the scandal is how much danger we're all in any time we're in public when the people who are literally responsible for our security are such low quality individuals.