One paper in the literature provides some partial data on this subject .
The paper analyzed 9 web applications using two methods: (1) black-box penetration testing, and (2) manual code review by an expert. It compared how many vulnerabilities were found by each.
In total, the analysis found a total of 91 vulnerabilities. 39 of
them (43%) were found by black-box penetration testing. 71 of them
(78%) were found by manual code review. There's no way to know how many more
vulnerabilities might be present that neither technique discovered.
Therefore, one possible conclusion is that black-box penetration testing finds less than half of all vulnerabilities present in a web application, on average.
Another conclusion is that the combination of both methods seems to be better than either one alone; they each detect some vulnerabilities that are missed by the other. In the paper mentioned above, neither method alone was enough to detect all vulnerabilities:
manual review found 52 vulnerabilities (57%) that were not detected by
black-box pentesting, and black-box pentesting found 20 vulnerabilities
(22%) that were not detected by manual code review.
However, this paper has a number of limitations. It looks at only 9 web applications. It is hard to know whether these are representative of all web applications in the wild. Manual code review was performed by only one reviewer. Black-box pentesting was performed by only one tester, and using only one tool. It is not clear whether the effectiveness of these methods might vary from person to person, or from pentesting tool to another. Therefore, this data is only a first glimpse, and can't be treated as the final answer.
 Matthew Finifter, David Wagner.
Exploring the Relationship Between Web Application Development Tools and Security. WebApps 2011.