This scan is so limited that I wonder if it even could be directly damaging. If the average Joe who set up a CMS for his business runs this and thinks "Great I got a 90% score our site is secure".
I think it's more of a start. I don't think an average Joe who got 90% will assume this. 90% is big.
Even large corporations rely largely on buying reports, and in turn buying products to fix the results of those reports as their primary security strategy.