We don't need to audit the source code. Just grab the binary, reverse engineer it, and study that.

There's an entire industry dedicated to reverse engineering software and studying its security properties. We call it the security industry. (Not every gig is white-box!)