Granted, all one might be certifying is a firewall or antivirus product in one set configuration, surely matching no one individual's set-up. But the certification is useful as a means of differentiation. Third, I'm not sure how to make security ratings meaningful. To be meaningful we do not have to have hard numerical measurements. We do need test criteria and test results.
Complex mechanisms have complex, or more involved tests, and fuzzier results.
Fourth, failures in network security are not always obvious. No argument here. For product certification, you test against products using known, good practices. When something new comes along, or you eventually find a hole in your logic, you change the criteria. Fifth, I don't see how a rating could take context into account.