One important point here... just because the source code is "leaked" doesn't mean it's comparable to Free/Open Source. If it was actually leaked (i.e. illegally disseminated and still covered by patents, copyright, NDAs, etc.), there's questionable-at-best legal ground for the good guys to audit it. In my opinion, once it's leaked, the owners/authors should at least legally agree not to prosecute/sue anyone who audits the now-public code.
I'm a sysadmin/developer, dealing almost exclusively with open source, and I spend quite a bit of my time neck-deep in the code we run. As to the Open Source question that's been raised here, we all know that attackers are busy pen testing and decompiling proprietary software. It makes sense to also allow the good guys to have a look. If for no other reason than I'd rather have everyone alerted about a vulnerability (in a hopefully responsible way) than just have the attackers know about it until the vendor decides to disclose.