> I’m really confused why in the 2020s anybody thinks that unsolicited pentesting is a sane or welcome thing to do.

Because bug bounties?