Software used to come with source code escrow licenses (a long time ago). A third party would certify that you had done the due diligence you just mentioned up front.

I’d like to see legislation requiring this for any software that a physical device needs in order to work, but I doubt that will happen any time soon. (“Right to repair” is meaningless without something at least as strong as source code escrow)