It depends. Auditing the mitigations defined in threat model does make sense with say IEC 62443. This would not be only penetration testing done. But it is reas

It depends. Auditing the mitigations defined in threat model does make sense with say IEC 62443. This would not be only penetration testing done. But it is reasonable process. You want to know if the mitigations you have put in place against identified threats work or can be thwarted from outside perspective.