This idea seems to rely on the flawed assumption that you can’t security audit closed source software. This is not an assumption I’ve ever seen an actual security researcher make.

Quite the opposite, they start with techniques they work on the binary and only use the source (if available) as a helpful reference. Hiding back doors in source has a long and storied history so relying on it to audit security has long been out of favor.