"Surely paying a pen tester $5k is much better than the amount of negative publicity you get when you lose $350K"

Depends upon who you're "losing" the $350k to.