To be fair, there are many professions in IT. Programming is just one of them. Computer security and system administration are two other very different ones. They don't necessary involve much "good code, testing, comments and such". On the contrary, they can involve in-depth, hands-on knowledge and experience of the kind of tools that other people will use, to be able to protect systems from them.
