Why can't Flock do a "customer setup" that is otherwise sandboxed from their systems and let the white hats go nuts on that?

Content is not the same as configuration and they could get valuable information if they cared.