I feel like pentesting as a job forces you to internalise a lot of pressure to find security issues, and that tends to lead to being slightly less realistic about threat models because you really want your findings to be important. The mental gymnastics become automatic.
This isn't a dig at pentesters or infosec folks, and it's only somewhat spurred by the Thunderbolt paper. I am 100% guilty of overstating the realistic likelihood of issues. The longer I've been out of the pentest industry, the more I realise I was probably doing it all the time.
Being exposed to a lot of non-infosec people on Twitter, particularly those who have to act upon pentest reports, makes me reflect on how many of the tropes I am guilty of and how much importance I placed on the wrong things.
I also suspect that having to constantly write reports that, by definition, are almost entirely framed in a negative manner, is likely to have an impact on day-to-day thought processes and, in turn, mental health. That's probably a question for a therapist though.
