The issue isn't malware authors acquiring it the source, the issue is that other people would then build said source and run it (XP) or worse, build products on it as XP was very stable. Those systems would then get infected and become botnets.

You don't see people flying in trijets anymore as they are dangerous, likewise you don't want to encourage or incentivize people to use or build products on an insecure OS.

Sympathy doesn't matter in the business world, costs do. No normal company is going to undertake a legal review of an unsupported product; it simply isn't worth it.