Compared to model checkers that just exhaustively search a well-defined state space, there's not a lot of reason to believe in opaque, large proofs of interactive theorem provers at this moment. Four reasons.
- There's a problem with the math. If there's one 'paradox' like Banach-Tarski, there are probably an infinite number of them. What if the proof exploits one?
- There's a problem with the logic. At one point in time, I understood the rather simple type theories people worked with. I don't understand the current ones, so maybe I shouldn't comment on it, but I am unsure how robust they are.
- There's a problem with the implementation of the type theory. Usually, that would boil down to a kernel bug, but there's ample reason to believe it may lie elsewhere. For example, the presentation of a proof.
- There's a problem with the formalisation. I.e., something was stated, but it turns out that didn't reflect the math correctly, and subsequently something else was proven.