I have always shipped test automation in production with my personal software. It allows users to independently validate the health of the product in their own operating conditions and write better more precise defects.
Wait... I may be misunderstanding but in the xz backdoor we just had, had the tests not be ran in prod, the attacker would have had no way to ever ship its mandatory evil binary payload and the attack would have been stopped dead in its track.
I'm very surprised to see this dismissed as "unrelated" when not including the test files in the prod environment would have prevented that exploit.
At least as I understand it.