Lots of places don't have tests at all. This is not uncommon. (Or even all that problematic if other processes and capabilities are in place).
I worked on a site supporting voter calls in 2004. There was no sanity checking of the usernames people proposed, so we had gems like leading spaces and multiple embedded spaces in the usernames. I figured some people signed up and then were never able to login.
I mean, not being able to sign up is fairly problematic.
True, but "server overwhelmed" is not usually one of the first tests written.
I'm referring to the inability to choose a password without some esoteric email-like rule-set.