Would they have legal right to do that, out of curiosity?
Hired oentest has company permission to do stuff on company property. I do not imagine they have right to do so to personal property.
Absolutely not. There is literally no framework, which would give you the right to exploit an employee’s personal laptop, that’s just cyber crime.
I think my security form said something along the lines of “using personal laptops to access company resources grants implicit permission for my company to audit my laptop.” It goes on to explain that if you don’t agree to it, simply use the company device only.