Even if they release their server side source code how can you ensure that the deployed version matches the source ? Eventually there is always a thread of trust.
The point however is that the government of India is forcing private corporations to break privacy related measures to suppress civil liberties.