Such source code isn't possible with the general audience service they offer, even if being open source were a requirement for credibility in any way.

You're comparing them to a company with a long history of actively hostile behavior despite the fact that there's never been a single hint of anything resembling hostile behavior from them, they operate from a country with meaningful privacy protections and only surrender data when compelled by their own courts (who only do so in circumstances that actually warrant it), and haven't actually given up information that's useful when required to because they don't have it.