Why would your code coverage metrics include Hibernate (to speak to the example in the post)?

Your code coverage metrics are only going to cover what you've written, not the included jar files. If you don't cover something in there then there's no way to know if it breaks until the bug crops up in production.