Indeed, but they are not random or arbitrary. They are typically the inputs that matter, and if chosen carefully then they cover all interesting/relevant inputs from the vast space. If you want to make things water tight, you use formal verification like I mentioned earlier (of which type checking is just a lightweight variant, in a sense) but for general screwups that's not even necessary. If tests are chosen well then the code must be formed very weirdly to produce bugs that the tests would not find.