Right. We also know how to do code signing and deterministic builds so you could build it and ensure the code you see is what is being executed and that is what is certified.
It's just rather boring to get all the ducks in a row to do it.
None of it is a requirement to work on the happy path.
To work as part of a reasonably secure platform that still allows people to develop on it and responsibly sell consumer hardware based on it, yes, it's necessary.
Welcome to the swamp of code certification testing. If I'm lucky to get sources, I also get a PDF describing the optimization flags allowed, and a checksum of every source file. It depends on protocol and domain, but it is very real.
Blobs are popular for a reason, and it's often for the sake of the user of the blob not the maker of the blob.
It's just rather boring to get all the ducks in a row to do it.