Absolutely not. There is literally no framework, which would give you the right to exploit an employee’s personal laptop, that’s just cyber crime.

Then that is something the pentesters cannot do, but malicious actors will do.

Game over.

What pentesters can do, should do, and often do is simply start the test from a workstation that is given to them - you simply assume a successful social engineering as the starting point, and test whether your process and technical controls can properly limit the impact of such a compromise.

Taking over that first engineer's workstation shouldn't ever have resulted in $6.3B of damages. I would consider it reasonable if those privileges could be abused (by e.g. the same engineer intentionally) to cause $6.3M of damages and the rest would be mitigated or prevented; so for this incident we could say that 0.1% of the impact was caused by the initial compromise of that workstation and 99.9% of the losses were caused by all the other failures - so it's effective for any pentest to focus on the latter part, ignore the social engineering and phishing part (since you can't really eliminate it anyway - unlike many other flaws) and assume initial compromise as a starting point.

Pen testers generally won’t physically assault your employees, bring guns and wave them around or shoot people, or kidnap their family members and torture them until they do what they want. What’s your point? Nothing.

I think my security form said something along the lines of “using personal laptops to access company resources grants implicit permission for my company to audit my laptop.” It goes on to explain that if you don’t agree to it, simply use the company device only.