The tests take a lot of money and effort, but their effects are worth it.
By allowing such tests, the organizations could readily identify previously unknown vulnerabilities and either eliminate them or make adjustments in computer and network use to lessen the risks.