Because it takes time to read the code, each person codes in his own style, then of course you have to adapt it to the system in place, read it again and again and see if there's shortcuts to be made to improve efficiency and THEN also check if there's nothing malicious written in there.
obviously the maliciou part is easy to spot, but the time and effort required to check everything from a 3rd party that has no idea how the devs work is just wasting time, sure 1/10 might actually work and be worth it, but what about the rest of the wasted time? Much better spent on doing it themselves.
people seem to have an idea that the devs don't do something because they don't know how, the chances of that being true is slim, the difficult part is making a fix that works with the rest of the server, not just a random "band-aid" that works for that specific problem but brakes 10 more in the process.