For the case of science, depending on closed products is obviously a malpractice.
Put another way: if your goal is to not ever harm your child, how can you responsibly feed them applesauce or let doctors administer them medicine when you can't be certain what went into the making of the applesauce or of the medicine?
With a very rigorous standard, you can't. With the most rigorous standard, you can't even if the chain of trust has a single link, and you'd only use food or medicine that you, yourself, produced. But we know that few, if any people, use such rigorous standards, and that, if they did, they'd be much worse off. It's not a perfect analogy for software or hardware, but it's certainly a salient one. With your standards, it's malpractice all the way down[0].
Closed products are the norm, in science and otherwise. 'Obviously malpractice' is a silly assertion to make, as sometimes there is no other choice.