Source code should probably be open for all employees, at least those that have signed a non-disclosure agreement, or whatever the company in question feels they need to threaten people with.
The "security" concern is vastly overblown. It's an open secret that bespoke enterprise software has had little concern for security in its design and construction. Anyone with a fuzzer can generally find as many security holes as they want. That's why most enterprises have their intranets heavily firewalled, and some even have an air-gapped "engineering network" for production systems. Any of the multiplicity of developers that work on any given application can pretty much crash them at will.
The only security concern that's viable is if developers keep passwords (oracle, or OS or whatever) in the source code. But that's a completely separate concern really. Any decent security standard will forbid that absolutely.
Mathematically, there's no security advantage to closed source. See this and
this and the first part of this. Anecdotally, reality works as the math says.
"Intellectual Property" issues are an entirely different beast. Given revelations in the SCO Linux Trials, companies may be protecting themselves from outside legal threats as much as their keeping their own "IP" from leaking out. Nevertheless, the benefit obtained by opening up may be greater than the detriments imposed by legal threats. Very few data points exist, so I believe that the "IP" lawyers or the "Risk Managers" are declaring source closed solely out of superstition. It's easier to say "no" than it is to say "yes" for the usual aparatchik in a corporation.