> If they don't have the binary, they can't find vulnerabilities in that, right?
No, vulnerabilities can still be found (and they've had the binary all along). This just allows them to decrypt it and inspect the source code, which makes it easier to identify vulnerabilities than a black box.
I think this wouldn't reveal any source code, but it would reveal the decrypted binary (which they did not have all along), so it can be disassembled and poked at for vulnerabilities.
Anything in particular that makes you think this is probable? There's evidence to the contrary as mentioned in another comment https://news.ycombinator.com/item?id=15040972
> If they don't have the binary, they can't find vulnerabilities in that, right?
No, vulnerabilities can still be found (and they've had the binary all along). This just allows them to decrypt it and inspect the source code, which makes it easier to identify vulnerabilities than a black box.