But you can’t legally modify it and distribute your modified version. You can’t fix a vulnerability and share the patched version with others. Only the developer can, so you are at their mercy. If they add spyware into the program, users can’t do anything about it.