Generally, it's not really useful to test a company by DDoSing it. As far as I know, normal pentest don't include this, and practically every bug bounty forbids it. The reason is simple: DDoS is an obvious threat, and everybody is vulnerable to DDoS at some level. Even massive sites like GitHub have been knocked offline in the past.
If you want to find out exactly how much the server can handle, it's possible to make an estimate by taking in consideration the amount of resources the server has available (i.e the bandwidth, processing power and memory available), so there is usually no point in actually stress testing the server.
Although a DDoS usually won't physically harm a server, it can still cause other sorts of harm. For example, your ISP probably won't be happy with you sending massive amounts of traffic, and it might even be against their terms of service.
On the server's side, if the server happens to use some sort of auto-scaling cloud service, they might end up with a gigantic bill for the large amount of bandwidth consumed. Alternatively, if the server is hosted with some smaller hosting service, they might discontinue their providing their service to you, since the DDOS could have caused disruptions for other sites hosted with them too.