The boring bugs still win
We rarely need a novel 0-day to ruin a launch. Broken object-level authorization, leftover debug endpoints, and tokens in query strings show up constantly.
Schedule a time-boxed pentest after feature freeze, not after the marketing site is live. Fixing IDOR in production is a press story you do not want.