The test results are only valid for the specific samples used in the test. The results are not an indication nor guarantee of generic ransomware detection or blocking.
Good or bad results in such a limited test are not something to get too overly excited or concerned about. Things change with time. Things change with different sample sets. Some are better than others. A review of test results over an extended period of time are the best indicator.
Of course you are correct, being a huge malware DB (there are millions of malware variants), who create these tests has to choose a limited number of malware in testing, but statistically representative: new threats and known threats.
But the selection criteria of the various categories are extremely complex.
For example, it is possible to test an antivirus against a higher number of threats, even if in reality they are not very popular and therefore there is little probability that the real user can become infected. Or you can select the threats, which constitute the majority of the causes of infections for common users.
Also by understanding what are the potentially most viral threats may change scenario due to many variables, for example, there are huge differences in the spread of infections on geographical level.
The tests can vary a lot by depending on the parameters chosen by who performs the test, and thus the results may change when you are testing the same malware in different tests.
Frequently it happens that an antivirus program will obtain an excellent result in a test, and mediocre in others.
So these tests may show a statistically correct evaluation of a product, but when the user sees the full green line in the chart with 100% detections, the subliminal message is clear but the reality may be different.
That's why I don't believe in these tests, technically correct, but the evaluation factors are limited to the perimeter of the test.
