"Deterministic" != "feasible to reason about halting states for all inputs." Running it locally to see how it behaves for a handful of inputs is definitely not sufficient for claiming that the code behaves correctly (i.e. is "secure").
Recall that people lost money in the DAO not because they didn't test how the DAO behaved when they sent their Ether to it. They lost money because someone discovered the contract as implemented did not behave the way it was expected and advertised to behave. Had it been possible to reason about the DAO's halting states for all possible inputs, the re-entrance bug would have been caught and fixed before the DAO was released.