If all they said was effectively “we did some pen testing at launch” without any claim of meeting any standard or going into much detail then even the most rudi

If all they said was effectively “we did some pen testing at launch” without any claim of meeting any standard or going into much detail then even the most rudimentary test/validation of the correctness of any vaguely security related code could be charitably considered to be a pen test.