Right, it's not going to exhaust the search space of inputs. That would be computationally infeasible for some kinds of inputs.

It also doesn't exhaust the set of all possible code execution branches, for example, like an intelligent fuzzer would.

Saying that it's "just" bruteforcing tests still seems a bit dismissive for what you get, at least to my eyes. Property generators are good at exploring interesting neighbourhoods of the search space. When they find a failure, they're also usually good at reducing the error input to something small.

As an example, it might learn that "@#*CH@R822cr21;'c09J@)RH0 92hr19h" causes an error, but then be able to reduce the input to learn that it's the apostrophe that causes the issue -- a strong hint that you've messed up parameter escaping somewhere in your function.