You can find vulnerabilities using a variety of techniques, but to properly patch them you do need access to the source code. These "updates" don't even modify the executables, so would have to be applied every time you turned on your P.C.