Facebook does pentests all the time, but they don't find everything. This is why you should also run a bug bounty program.