If I have a big company that sells a product, I might not want to disclose its source because people may just copy it and sell it, thus decreasing my profits.
But if my big company provides a service by means of a Web application, it's very likely that I can publish the source code, because the actual value of my service lies somewhere else (in a large and complex infrastructure, access to databases,...).
What's more, I could actually earn the trust of additional customers by showing them that my code can be audited by lots of people, including the customers themselves. For example, this may show to the customers that my code doesn't store their data in plaintext.
That said, any Web application is extremely likely to contain vulnerabilities that can be found by an attacker, with or without access to the source code. If you don't publish the code (barring bug bounties), the good guys can't disclose vulnerabilities to you. If you do, they can. Of course, bad guys exist in both cases.
Finally, realize the hacking world isn't split in purely good and purely bad guys. Some people want companies, and the whole world, to know they're good at finding vulnerabilities. Perhaps getting their name on a Hall of Fame (that's why bug bounties are good) or on the credits section of a Github repository is enough to satisfy this "need". If you don't publish your code, the only way these people have to get what they want is to attack your application or sell a working exploit against it.