alpha numeric does not enforce both letters and numbers. it only enforces that the entry is does not contain characters that are not letters or numbers.
your entry:
123456789
passes, because there are no none alpha numeric characters.
the validation is woking as expected.
to force at least one number and one letter in the string, you would need to use a regular expression validation:
/[a-zA-Z]\d|\d[a-zA-Z]/