The good/dangerous bugs require creativity and deep system knowledge to find, which is hard to trust that an unknown person has.
It is sexy and all to sell "we hacked you using emacs through sendmail by the moon phase exploit that happens every 2 months". But really how many people will be able to exploit that? My company is not target of a state sponsored actors. Automated tools, checklist evaluation and decent administrators will be good enough for most of companies. Ordering pentests from time to time is good practice to check if administrators are doing their job as in "trust but verify".
Trust is easy. You either have a proof of concept and can show impact in your report or gtfo basically.