Counterpoint: pentests are good to catch regressions over time.

Should it be your only security strategy? No. But it can help in combination with other solutions.