Exposing their backend code to the public would be inviting bad actors to find loopholes in the logic. Your excuse for how they’re not secure is in fact one of their security features. No code is perfect, and you give enough people enough time to peruse through your software they’ll find a flaw to exploit. So they only provide their code to 3rd party audit companies they trust.