You're right it isn't realistic, but it's the only way to fully know that the application is secure. Otherwise you're putting your trust in something/someone.