This is not actually a matter of security, but of psychological evaluation and human-associated risk assessment.
A sentence does not necessarily make a person evil or destructive.
If one hacked a gov site out of curiosity and you hire him in your company and put him in charge of data security, automatically granting him access to your data, his has no curiosity about your data anymore, therefore he can do harm due to that. This is a simple example, but there are dozens similar.
On the so-called legal side, there's a big debate also. Current laws are less and less based on morality and end up re-defining morality as the ones in power will it. Therefore, a sentence-based on a current law does not necessarily mean that the sentenced person did something bad, even if at the point of its sentence it was considered illegal.
May companies prefer to hire previously sentenced security experts because a sentence by a high authority means usually skill proven beyond any doubt.
The companies filter them out, find a person fitting their requirements and hire that person.
Having a person in charge of security automatically implies a high level of trust in that person. Here, the evaluations come in. If the evaluations are done by competent people, everything ends up fine and I personally know quite a few situations where it happened so.
Evaluation such a person may be an extremely complex thing to do, but it also may be pretty simple, depending on the situation.
Let's take some other examples: why should I not hire a person that hacked a football's team site for fun ? Or a person that obtained restricted data out of pure curiosity ?
I would certainly hire them. But then, I would not hire a person hacking sites for profit. This will inevitably result in that person being susceptible to bribe and to selling my data to the highest bidder.