I think you haven't seen enough. Self assessment is a great start. I've seen companies demanding their vendors to go through pentesting from several different p

I think you haven't seen enough. Self assessment is a great start. I've seen companies demanding their vendors to go through pentesting from several different pentesting companies, and then addressing all high-severity issues to the satisfaction of the pentesting company before officially allowed as a vendor. Naturally you still have to trust the pentesting company to do a good job but it's better than just a self assessment.