Yeah, from it's TOS: Prohibited Conduct: " reverse engineer, decompile, disassemble or otherwise attempt to discover the source code of the Service or Hotspot Shield Software or any part thereof, except and only to the extent that such activity is expressly permitted by applicable law notwithstanding this limitation;"
It is just a common thing for proprietary (mostly)/closed source software. Of course, if the source code is visible, we can see if any malicious thing is present. Even if the source code is visible, guys like me don't know programming so there is no use! And open source is a baby. There is along way to go.

Come on, you can't make everything 'open'. Imagine like this: If an anti-virus doesn't encrypt (well, by seeing
https://secure.avast.com/web/eng/vir...ction_and.html I'm sure that Avast encrypts it's virus database. Panda doesn't? o_0) what would happen? Most likely hackers may check if their virus is identified in the virus database and act accordingly. Well, hackers many check if encrypted too. This is why most popular Avs fail to detect some I think. Anyhow, heuristics may help! But AVs must hide their data base for God's sake.
They also steal. E.g.: Many sites (including the hilarious Uncyclopedia "the content-free encyclopedia") steal Wikipedia's design. I didn't see any legitimate site stealing others' theme. And using similar theme confuses viewers just like the popular "The Onion - America's Finest News Source"
