Blobs can be decompiled and examined. Closed source code isn't a black box. Security research can be done on it in various ways.