Pretty much a lot of “training” in cyber security is a mix of best-practice and how to hack shit, so employing people who have experience in the field isn’t a terrible idea provided you can vet them.

After all, Mitnick started up a successful cyber security company and many others have hired people who have been caught doing clever but naughty stuff due to being curious and bored target than actual malicious intent.

At the least, you’d probably be more likely to get somebody who knows how stuff works as opposed to some of the “I clicked the scan button and ran a pentest report sorted by CVSS score” types who know jack shit about actually security.

“Poachers make the best Gamekeepers” has been a trope for centuries. “Hackers make the best Cyber Security Experts” is just the modern iteration of it. You’re screwed if you try and do it on the cheap, but pay them well and they are happy. They get to use their skills, and play, while their money is now all legit.