On top of just "compliance" or "customers demand it", these types of penetration tests can and do expose real, serious vulnerabilities in software.

Furthermore, I wouldn't underestimate the positive press that having a third party security firm assess your product and share the results publicly. VPN Services have been under special scrutiny lately so I think something like this makes total sense for Mozilla, regardless of the cost.