Openness makes it not just readable to them, but to everyone. If they can show the public that the checksum matches, and the code shows equality, then everyone's happy. If they keep it to themselves then they'll probably just cause too much suspicion. Why do it that way when they could fully open it up and remove that suspicion?