This is not as simple as it seems. I'll try to answer in a way in order for you to think about it some more.
Is it fair to say you can't get around IP White-listing if you were a malicious actor? I guess you could IP Spoof but the return packets will go back to the owner of the IP.
Although it appears that sufficient mitigation's are in place, it also depend on the infrastructure behind it. I'll elaborate with some examples:
Are there WiFi access-points that, when connected to, have the same public IP address? How secure are these access-points?
How is access to the environment (office(s)) gained? Can someone walk in and hook up a notebook/access-point? How strict is it? Do you use port security?
Is it worth performing a third party pen test on these SFTP endpoints, if so what would a penetration tester be looking and testing for?
Whether it is worth it is opinion based and this is not an opinion based community. As far as what I'd examine/investigate as a penetration tester:
- How does one gain physical access to the building?
- Is port security active? If not can I place a hidden access-point? How long will it take for someone to discover this access-point? (assuming it has the same public IP address which is required to connect to the other SFTP server)
- Inspect the SSH configuration by examining the sshd.conf file (white-box approach).
- Check for the used MAC and key exchange ciphers and determine whether they're considered safe for the moment.
- On the server itself (assuming a white-box approach) examine the password policy.
- For the SFTP server, is one account used (per user) or is considered a group account?
- I would ask question about HR policies and procedures. If someone leaves the company, are the used password(s) rotated? In case of a group account, is the current password revoked and a new one generated.
Additionally, I would like to add that policies and procedures should be in place. The company should have specific classifications in place when it comes to PII or other sensitive data.
Based on the classification, specific measurements should be taken. Are these in place?
I hope this helps you in deciding whether you need to perform a security assessment / penetration test on this environment. As you can see, there are many dependencies.
Please note that the questions asked here are for you to think about and not actually answer.