No, that kind of audit is neither necessary nor sufficient. (A firewall works without application source code, and trusting trust means we can hand wave anything even with source.)

Ok, at least if it has network access, but can you recognize that this was a vulnerability, and that you're talking of something only tangential to it?