In theory, an insurance company could inspect and pen-test.

In practice, that would run into (probably, IANAL) legal issues, cost & staffing issues, and the narrow worldviews and business models of the insurance industry.