As long as the build is reproducible then they don't have to open it up. It would mean however that you'd still need to audit the compiled program to find anything injected in by the compiler.