This is absolute pedantry. Nobody claimed that Yelp is offering services within the security industry. They are "in the business" in the sense that they are concerning themselves with security to such an extent that they have a policy and are kicking people out of events based on a blacklist (after the fashion of an authoritarian government).

Since they are doing it they should be concerned with doing it right.

If computers are critically important to a company (as they are for many web companies) then they are expected to manage them in an intelligent way. That doesn't mean that web companies are all acting as ISPs, but it is absolutely routine and expected for them to take various measures to maintain their computing infrastructure correctly. It's irrelevant that they are not selling computers.

It is totally irrelevant that Yelp is not selling security services to other companies.