How and when do reverse engineering come in handy in an average pentest whose target is a company system and not just a single piece of software?

I dont think anyone uses zero day in a pentest.

Reversing might be used in a incident response to understand the infection or malware