(replying to your "What if $40k for a pentest becomes a rubber stamp?" question, which was an important observation)

Mm, it can become that. It's important to get a pentest from a reputable firm. At the one I worked at, it was a point of pride to come up with clever attacks. We'd make a sport of it and try to one-up each other. But it's easy to imagine some other pentest firm just going through the motions, running Nessus and calling it a day.

Unfortunately, that's where money really does make a difference. $40k is at the low end of how absurdly expensive pentests are. Yet they make all the difference -- one app that I pentested was at a trading firm. I took that app from "typing ' leads to SQLi in their Node backend," and "there was SQLi in their Java backend if you were clever" to "you'd have to be more clever than me if you want to breach this app."

Most attacks come from unsophisticated adversaries. This implies that raising the bar higher than these guys gets you 80% of the way home. The other 20% is much harder, but it's doable if your company has a culture of caring about security.