If security researchers couldn't audit closed source software they would be pretty rubbish at their jobs. It's a lot easier to audit open source of course, but

If security researchers couldn't audit closed source software they would be pretty rubbish at their jobs. It's a lot easier to audit open source of course, but researchers do reverse engineer closed source stuff all the time.