How can I as a developer be sure my unit tests are complete? How can we develop or improve that ability to think "what could go wrong?"

I don't think they developers of Android, iOS, or the PS3 (and many others) were using insecure coding practices. They still got rooted over and over again.