There is an important factor discouraging publishing source code - fear that there indeed are bugs and they will be exposed. This is blatantly "security through obscurity", but I fear it's a common attitude. If there are bugs and code is secret, even if someone else later points out that the results contradict their own findings, it's (presumably) not difficult to sweep the thing under the rug and cool it down. On the other hand, if the paper is published, code is public and someone spot serious bugs, it's instantly a big shame... (code review as a part of peer review would help, but it's very unrealistic - already, reviewing is very time consuming).

In addition, there are really no structural/institutional incentives to produce and share good quality scientific code. Maintaining good code costs much effort and, currently, gives few short-term benefits. It's often easier to produce crappy code, get the results, publish and move ahead.