@dymaxion @kaoudis You are right, and now I think here lies the solution: with pentests you want priorities based on how an external party sees your system. Does this make sense?
(having to think about these things shows how much time passed since I started doing pentesting...)