I'd love a specific example? Because in many countries if they're publicly-traded or subject to other regulations (such as Basel, etc.) any company that didn't would be breaking the law.
If Basel requires that level of auditing, I'd love to see a cite. There are some pretty heavy-handed regulations out there, but this would be clearly unworkable.
I wonder what laws you're referring to that requires companies to have read the innards of products they deploy.
Even the "getting a support contract from someone who does". Do you think for example Red Hat has read every single line of code shipped in RHEL?
I've never seen what you describe. And one of the companies is a huge multinational.
Also which law do you think they would be breaking by not reading the source code of products used?