I would argue that any testing is better than no testing. The problem with ad hoc testing is it runs the risk of creating a false sense of security or is not targeted at the right level. The business feels it has overall increased security due to the ad hoc testing. This may be true, but at the same time, due to the nature of this type of testing, it is quite possible that a major security hole has not been identified.
Security for small business is extremely difficult. In addition to the lack of staff resources available to perform the work, you frequently have a low level of security awareness as well. Getting basic technical configurations right is relatively easy compared to ensuring the users of the system are informed and don't do silly things, such as click on bad links in suspicious emails. It really doesn't matter how much testing of the software and infrastructure you have in place if one of the users is going to accidentally bring malicious code into your network and bypass all your measures put in place to protect the systems.
One of the largest challenges in small businesses is getting the owners to realise that information technology investment is different to other infrastructure investment. When you invest in new physical assets, such as a building, updated furniture and fittings etc, once that investment is paid for, you normally won't need much on-going investment/maintenance. With IT infrastructure, the on-going maintenance and need for on-going investment tends to be much higher. Too often, small business think they can buy a server, possibly pay someone to develop a little bit of specialist software and their done. They fail to recognise the on-going investment required to ensure the server is patched and up-to-date, the maintenance for the simple bit of software to ensure it stays current, is compatible with later versions of supporting software and operating systems and is patched against evolving threats etc.
My approach is to actively discourage small businesses from running infrastructure where possible. I encourage small businesses to take advantage of SaaS and cloud services. As far as possible, limit what IT they are actually responsible for maintaining to the absolute minimum. This can be a challenge as they don't understand all the hidden costs - it looks cheaper to do it yourself. You need to expose the hidden costs to allow them to make a fully informed decision and ensure this includes some basic regular testing/checking, reliable automated backups etc and ensure there is a plan for when things fail. The plan needs to include how to recover from the failure i.e disaster recovery as well as how to continue business while you are recovering i.e. business continuity.
In those situations where the business has no choice other than to run/develop their own software, look for solutions which will limit their need to invest in security. For example, a hosting provider where the hosting company takes care of hardware and operating system security and the business only needs to worry about application security. Work to help the business develop procedures which facilitate good practices and understanding of the risks and try to ensure these actually reflect the real risks faced by the business (rather than just implement good practice, assess the risks specific good practice is designed to protect against and determine if that really is a risk for that business) and recognise you cannot eliminate all security risks - there is never enough resources. You need to identify exactly what the real risks are for the specific business and prioritise them so that whatever resources are available for ad hoc testing are targeted at the highest priorities. Clearly communicate the risks which are not being addressed and what their likelihood and consequence is so that the business can make an informed decision as to whether they need to invest in additional resources.