You're right, "trumps" isn't the right word there. But, as you say, testing is an often neglected part of the process. There are absolutely issues that code review is going to be better at finding, particular security related ones. But, try fixing a subtle bug without a reproducible test case...