Personally, I do use adversary tools and techniques to test my target systems, networks, and apps. For the web layer, as an example, tools like Acunetix WVS have historically been warezed by online criminals.
Metasploit is a bad example for this scenario proposed by the questioner (and as alluded to in some of the comments). A better example would be to use adversary simulation by way of Cobalt Strike's Malleable C2 to repurpose active, real adversary IoCs such as network traffic and on-disk (or even in-memory) malware file hashes.
The social engineering techniques, or really any TTP, can be matched closely to realistic events. This is more of the purpose of a red teaming analysis, to be used during a cyber exercise, than in a penetration test. Penetration tests seek to understand the perspective of a trusted insider, such as the developer him or herself, not that of a simple unintentional insider, such as via spear phishing, waterhole attacks, or similar.