The BT blob (or WiFi blob, or general radio blob) often controls low level aspects of the actual RF device. So you can often alter frequencies, power levels and other parameters. This results in the device acting out of spec.
Now one might say that's the fault of the person doing the modifications/manipulations, but regulations in various countries require the device to prevent these manipulations.
(N.B. I'm not in the exact business, but that's my take away from looking into the topic some time ago)
I think often it's also a combination of what you described and big companies being super risk-averse. Why risk breaking regulations if you can just say no?
Then again, lots of Wi-Fi-enabled devices support simply changing their region setting and will happily let you use different Wi-Fi bands or increase signal power.
Surely it's possible to maintain control over that while still publishing the source code? Seems like security by obscurity.
To be fair, depending on your partnership you actually do get the code to these blobs, and export control comes into play.
That was my takeaway as well when I was working with Bluetooth modules a few years back.
There were a few more reasons too, at least at the time. The companies in the space didn't have a culture of open sourcing, and there's probably no perceived commercial upside to releasing code for a chip like that.