Both probably. Also patent trolls ("Using a for loop to sequentially read the bytes of a file" and what not). Finally, I suspect at least part of the reason is

Both probably. Also patent trolls ("Using a for loop to sequentially read the bytes of a file" and what not). Finally, I suspect at least part of the reason is that the source code contains a number of heuristics that, if known, are easier to circumvent for malware developers.