There's a big distinction between pen testers who write a bit of code, and developers of security tools.
During a pen test, you may need to write some custom code. For example, if you find server-side template injection, there's likely to be no off-the-shelf exploit that works in this exact scenario. But with a little bit of coding you can get a shell. These scripts just get the job done; design patterns are irrelevant.
Many security tools are much more complex than one-off scripts. Metasploit is a good example. Before Metasploit, most exploits were developed like one-shot pen test scripts. The exploit would target a specific vulnerability and deliver a specific payload. Metasploit introduced modularity and structure into exploit development. In particular, separating the concepts of: exploits, payloads, and encoders.
In fact, there are now all sorts of security tools that are developed with strong design practices in mind, although a lot of these are commercial, e.g. Nessus, Checkmarx, Burp Suite.