I’ve been primarily pentesting medical devices for the past few years and these companies will never willingly hand over code. If you want the code to audit then you’re going to have to yank it out of memory, a jtag or come up with some other disclosure. Not to excuse these companies, but they’re under an enormous amount of regulations between so many different regulatory bodies. But there’s a lot of reasons why infosec people avoid medical stuff in the first place, it’s not for the faint of heart. But then there’s probably worst stuff out there.. like auditing diebold voting machines.

How would publishing the source help?

There are plenty of reasons that are reasonable for saying “source code should be available”, but “the software might have bugs” is not one of them.