About the first, pentesting that gives access to secret board meetings through company laptops must raise some eyebrows. I am not sure that is legitimate pentesting, though.

About the lack of xss vulnerabilities that probably doesn't generalize to e.g. WordPress or bbforum software which are installed client side.