If you have the access to the machines to hack a number of them you likely already have the access to dump and analyze the source code, the physical access required is basically the same in both cases and getting the code initially is easier because you only need one machine (/maybe/ two to see if there's any interesting differences) where the final hack would require more. Also just because the code isn't released doesn't mean it's secure that same bad actor can theoretically hack the same code out of the writing company to start with.

It's a debate we've had with secure messengers the benefit of having that many eyes on a piece of software outweighs the minor risk of a secret zero day.