You are probably right that getting a high score on the scorecard doesn't guarantee a secure program. (The standard of the socrecard is not high.)

But can't you still argue that getting a low score on the scorecard would probably mean it's not a secure app?

Having key's held by the creator is a sure way to undermine any security model, having externally auditable code is a measure to ensure people can independently verify if code is secure or not (or if it's taking a carbon copy for it's creators) etc;