Not OP but from what I understand, the problem is that their code has to interoperate with the “private” service run by the “bad guys”; it’s basically a more usable front-end. So the bad guys keep messing with the backend just to break the open client.