The real reason is that there’s realistically only downsides for the company. The public doesn’t know what “responsible vulnerability management program” means,

The real reason is that there’s realistically only downsides for the company. The public doesn’t know what “responsible vulnerability management program” means, but they certainly know what “major vulnerability found in Boeing code” means. So doing that will only mean they gain nothing, or take reputation hits. Open sourcing the codebase doesn’t mean that all it’s vulnerabilities will be discovered, and it’s certainly not the only way for a company to manage them. Out of all the options that are available, it’s really one of the worst ones from the company’s perspective.