They don't need leaks to find vulnerabilities... although the source code would probably help.