I used to do this same thing and never heard about pen testing firms being sued by their client. Most likely he was spinning a yarn.

It is more likely that a security consulting firm will be sued if they report no issues and the bank is later compromised.