Then that is something the pentesters cannot do, but malicious actors will do.

Game over.