Here is a very recent topic that touches on the same issue: Why OpenVAS does not find all open ports compared to Nmap?. Takeaway: each tool is different, and may yield different results. Not to mention false positives and different testing methodologies.
Simply put, automated tools make educated guesses and interpret results. They get it right, most of the time.
But you must understand how the tool works, what it does (and does not) and be able to tune it for optimal results.
A simple example: by default nmap, Openvas etc do not scan all tcp/udp ports but a selection of the most popular ports, that is a few thousands out of 65535. If you are not aware and run the tools with default settings, you can very easily miss active ports. For example, many sysadmins choose to run SSH on some random port rather than the standard 22.
The automated tools usually have plenty of options, and not just one button - so you have to understand what they do or you are shooting in the dark. Then, your audit is not in-depth and has little value, because you don't know what you are doing, and what you should be looking for. All you've done is scratch the surface and look for the most obvious flaws.
Put it differently, why should we hire professional pentesters if all it takes is downloading and running a tool ? Because a competent pentester has experience and will go farther and can find vulnerabilities than a script kiddie will miss.
It is rarely "as simple as running a tool".
A properly-configured machine that is exposed on the Internet should have some kind of defense mechanism built-in: a firewall and/or IDS that will thwart this kind of reconnaissance effort.
When they detect port scanning activity, they typically react by blocking your IP address, or they throttle the traffic, drop some packets selectively or choose to return deliberately misleading results to frustrate hackers. You end up with incomplete or downright bogus results.
Keep in mind that tools like nmap, Acunetix etc are noisy and usually very easy to spot (and block) by an IDS because the traffic they generate has typical signatures and patterns. So unless you are testing a machine that is unprotected or loosely protected (on a LAN perhaps), you'll have to tune them quite a bit to achieve meaningful results.
So the answer is that you do both: you use automated tools and then you do manual testing, especially when the tool detected something, like an open port but was not able to exploit it, or you want to double-check.