I think many companies probably don't like to be open source because - they like the idea of "security through obscurity". Open source means more work patching

I think many companies probably don't like to be open source because - they like the idea of "security through obscurity". Open source means more work patching found vulnerabilities, so they rather not publish their code and instead tick check-lists for compliance and do blackbox pentests which makes them look secure. - like to do marketing that exaggerates the innovation of their product. That's difficult to do if everyone can see the code.