Does my small business website need a penetration test?

Usually not - and a consultancy quoting you one before checking your basics is solving the wrong problem first. The median Australian small business website scores 20/100 on the Security category - grade F^* - and the gaps behind that grade are missing headers, absent email authentication and unenforced HTTPS:

• What a pentest is - it pays a skilled human to actively attack your systems and report what broke.
• When it is the right spend - when you have something bespoke to attack: custom-built software, a customer portal holding sensitive data, or a contract or regulator that names a testing requirement.
• The common gaps don’t need an attacker - finding missing headers, absent email authentication and unenforced HTTPS needs a checklist and an afternoon, not a pen-tester who would list the same items on page 1 and charge thousands for the privilege.

Fix what a free scan can see first; pay a human to attack what is left.