None of it is a requirement to work on the happy path.
To work as part of a reasonably secure platform that still allows people to develop on it and responsibly sell consumer hardware based on it, yes, it's necessary.
Welcome to the swamp of code certification testing. If I'm lucky to get sources, I also get a PDF describing the optimization flags allowed, and a checksum of every source file. It depends on protocol and domain, but it is very real.
Blobs are popular for a reason, and it's often for the sake of the user of the blob not the maker of the blob.