That is an invalid argument. The presence or absence of other means of validating security controls does not affect whether BAS constitutes a means of validating security controls. Justifying a solution because: "What else are you going to do?" is similar to justifying the use of rhino horn as an aphrodisiac prior to the invention of Viagra because: "What else are you going to do? Nothing else is known to work."

The only thing that justifies a validation scheme is its ability to provide an accurate quantitative assessment of the thing being measured that can be translated into business value. In the case of security, this would usually be a quantitative assessment of your security relative to a threat model and actionable information that allows either a more accurate assessment of underlying risk or an indication of where to deploy resources or how to deploy them more effectively.

Personally, even if I accept your claim that it is better than a penetration test and less than a team of penetration testers I do not see how this is very useful. Any substantial threat to a commercial entity can easily round up enough resources to be comparable to a team of penetration testers. As essentially any moderately competent team of penetration testers can completely compromise any commercial entity, the actionable information gained from penetration tests on most commercial systems is: "Your system is hopelessly insecure against substantial threats.". Therefore, inserting another level of threat competence below that allowing you determine if you are "hopelessly insecure against insubstantial threats" vs "hopelessly insecure against substantial threats" is not particularly helpful. It would be like testing bulletproof vests against BB-guns, even if it succeeds, it does not tell you anything useful about its effectiveness against the actual threat.