> something would have stopped the breaking change making its way to prod?

or a prod outage causes the knowledge to be experienced.

I'd guess testing is done only for the software being deployed, not for that other microservice.

At least, that's what people do by default.

> If code reviews are important, where does testing sit?

Testing is for general boundaries. If you have a formalized specs, investing in an harness and writing a lot of tests is worth it.

But more likely in a corporate system, fully documenting everything is a huge hurdle by itself. So your best bet is to gather everyone that is related to a change and let them evaluate its impact.