Fair point, though not strictly true. It's possible to conduct both audits and black-box testing of proprietary systems, and some of these provide source fairly liberally.

Microsoft provides examples of both. Samba's Andrew Tridgell has commented that the team knows many ways to crash or compromise Windows systems. Microsoft's academic code licensing provided pretty liberal access to OS source code. Similarly corporate partner licensing for contractors.

Though security didn't exactly thrive under that regime... PGP is another company that provided core crypto code for public review, though it wasn't Free Software.