It is way easier to find a software vulnerability in a backend you have the code for, instead of probing a black-box backend for vulnerabilities. For instance, you can use static analysis tools to discover vulnerabilities.