As a thought experiment, I think the best course of action for these freelance pen testers - assuming they incur no actual liabilities for being wrong - is to s

As a thought experiment, I think the best course of action for these freelance pen testers - assuming they incur no actual liabilities for being wrong - is to simply declare everything they test "secure" without putting any actual effort into it at all. If they can manage to do this at any scale whatsoever, there is basically no downside, because there's a huge disconnect between the impact of a false negative (site breached, data stolen, etc.) and the impact to them (a 1-star review - even in your nightmare scenario as a customer, you still give them a score of 20%!) 1) A large number of the people who come to them will have actually produced secure code, so broken clock theory prevails, and there's no downside. 2) Another large subset will never generate enough interest among hackers to exploit their insecure code; a tree falls in the forest and no one hears it. 3) Another subset still will never know they've been breached and have cause to action. 4) If a company does learn they've been breached, they still must connect the dots to the failure of the pen tester. 5) And even then ... 1 star and some bad PR! And of course if there were actual liabilities, they wouldn't be charging $35 on a freelance site.