I've talked with security professionals who have told me they prefer to not have source so that they don't get lazy. The bugs you find via black box methods are

I've talked with security professionals who have told me they prefer to not have source so that they don't get lazy. The bugs you find via black box methods aren't always the same you would find through scanning the code. Assuming the attacker also lacks source, you're better off finding the bugs they would find through similar methods. I don't work in security so I don't know if this is a commonly held belief.