What Burp does is intercepting a request and allowing the user/pentester to modify it. Technically it acts as a proxy, allowing the user to send pretty much arbitrary input to your application (server-side).
You seem to assume, that requests can only be sent using your app. This is not true and generally pretty dangerous to rely on. Keep in mind, that everybody can do a "Bash-Fu-1-Liner" using cURL and send literally anything to your server. Your webservice has to be prepared for that! If the only input checks you perform are client-side (which is untrusted code as users can mess with it), you have to overthink your security measures.
Separate client-side and server-side. Think of them as two pieces of software which have to be secure on their own.
Edit: As you added a test case to your question, I'll add the answer here. Penetration Tests flag a lot of things as potentially dangerous. It may be true and little bugs, which don't look like they can wreck havoc on your server, will do so, if exploited properly. However, a Penetration Tester will scan your app, test around, find bugs and report everything which looks dangerous. Keep in mind, that he does not know the application as well as you (or the Software Engineers/Developers) do.
Bugs found by him/her might be false positives and it's on you (and the tester) to verify bugs and prioritize them (irrelevant - critical) according to their damage potential (and other factors). Once in my environment, a pentester's scanner found a document which was reported as "Privilege Escalation" as its regular link is behind a login. False Positive, as it was an unimportant document.