They might be afraid their algorithms would be too easy to manipulate if you knew all of it's factors. Since testing the all of the possible factors would be cost-prohibitive for most, it's not exactly 1:1 with software development
It's not really relevant what they're afraid of. They should be made to be transparent, and it should be enforced when they don't meet the mark.
Similarily I've not really seen any sites which publish how their anti-spam filters work or what the treshold values are either for similar reasons. They're possible to figure out, but cost a lot more.
Maybe a better solution would be to somehow guarantee that they're consistent with their own rules, and regularly audited so that they're also compliant with the current law?
The worst scenario that seems to fall out of this is "evolving arms race between bad actors and the metrics".
To me, that doesn't seem anywhere near as bad as the (current) lack of transparency.