There are plenty of US corporations who don't look further than a SOC2 report.
reverse engineering stays under "fair use" when it's for interoperability purposes
Which is an order of magnitude harder than reading the code.
Of course but the investments needed in obfuscations and the bugs introduced are orders of magnitude more important. It looks a lot like the struggle between ad providers and ad blockers - the ad blockers may be lagging behind but eventually they catch up.
Same things with scrapping