"Secure" sounds like a binary attribute but it's actually not. A formal proof doesn't save you from errors in the specification. At some point you need trust, the amount of trust needed is inversely proportional to the security.
Without a formal proof there is no measure of correctness at all.
Lots of passing tests mean nothing to you?
When an exploit only needs one edge case not handled right? No, lots of unit tests means nothing. Maybe less than nothing due to the false sense of security they seem to give you.
So you trust a software that has had zero testing equally to a software like sqlite that has extensive testing?
lets not go too far! tests can provide a security advantage over regressions or bugs introduced in the future. They are necessary but not sufficient to prove a particular security level.