Is exploit researching different from penetration testing? Yes.
Is exploit researching part of pentesting? Usually not.
Good summary of what penetration testing is is here: Wikipedia definition of penetration testing.
Simple penetration testing
A lot of penetration testing work is actually just running pre-existing, well-known attacks or exploits. (Like e.g. run MetaSploit.) This work is based on some modeling of where the relevant problems may lie. But does not actually involve exploit researching or reverse engineering.
However, going deeper to penetration testing, it is not sufficient to use tools which are completely off-the-shelf. On this stage, people:
- Consider the target system (its operations, and its possible weaknesses) in detail
- Create attacks based on the target system
The analysis of target system is usually on level of examining its high-level design, components (like web servers, frameworks, communication protocols etc.).
This analysis can of course go as deep as reverse engineering or source code review, but often already higher level details are good enough to sufficiently nail it down how to attack against the system.
More elaborate description of usual stages relevant for penetration testing can be found in this previous answer What is the difference between a penetration test and a vulnerability assessment?
Why not reverse engineering or exploit researching
The reason reverse engineering and exploit researching is rarely important part of pentesting is that pentesting is being made for the owner of the system. Therefore, the attacker is already given much better tools than exploit researchers typically have: the system is usually revealed to them in detail to allow them to do their work efficiently. (In other words, they are allowed to short-circuit much of exploit research.)
Python and scripting
The reason scripting is important in penetration testing is that penetration testing usually involves large numbers of very similar test cases. To make those small variations efficiently, scripting is typically used.
For example, Metasploit which is common tool to use on this field can be scripted using python.
In addition to python, some other scripting languages, like Ruby and perl are used.
I mean if you can reverse one program probably you will be able to find a vulnerability, but for this you need to be good with C and Assembly.
In case of well written software I would disagree. Even if you have access to original source code of the software, typically it is hard to find vulnerabilities.
If you have only access to the binary, it is even harder, as you effectively need to decompile the software, and lot of knowledge has disappeared and the code is no longer in easy to read format. Modern software is large enough that it is very hard to concentrate on important parts of the binary and dig essential vulnerabilities from it.