If it's sandboxed and accesses only the resources (network, disk etc.) you explicitly allow it to, you don't need to know how the processing is done. Spyware is not born out of legally obtained closed-source software. It's born out of corporations selling centralized SaaS, infringing on users' privacy and locking them in by design. The very same corporations championing OSS big time, because it benefits their spyware business. With thousands of naive contributors slaving off for posterity and hope that they will get noticed and hired. How ethical is that?

Granted, if you sign an NDA and pay extra, you may have the source. If this is the model you suggest, I think it's fair.