On top of just "compliance" or "customers demand it", these types of penetration tests can and do expose real, serious vulnerabilities in software. Furthermore

On top of just "compliance" or "customers demand it", these types of penetration tests can and do expose real, serious vulnerabilities in software. Furthermore, I wouldn't underestimate the positive press that having a third party security firm assess your product and share the results publicly. VPN Services have been under special scrutiny lately so I think something like this makes total sense for Mozilla, regardless of the cost.