The code is all there in the open.

My S1 release is not a firmware, just a binary.
I paid for my first S1, Bitmain provided another one much later.

My S2 release firmware is created by me - I fixed the bitmain firmware and added in a working cgminer.
Bitmain did not pay for my S2, they just shipped it and it arrived in pieces and then did the warranty fixing it.

BFG copies code from cgminer regularly - it started off being forked from cgminer and most of the important changes are copied from cgminer ...
e.g. the Klondike driver that Chris Savery wrote and then I rewrote a lot of it, got copied straight into BFG ... but then hacked to use an unreliable libusb