Why is a secure-coding check not a sensible acceptance test for commercial off-the-shelf (COTS) software?

You normally get COTS software as a binary without source code, so there is nothing to review against secure coding rules. Acceptance tests check what you can check: package integrity, malware, and known vulnerabilities.

Acceptance testing a bought package asks whether it arrived as the vendor built it, and whether it contains anything known to be bad:

• Integrity check: the signature or hash matches the vendor's, so nothing was altered in delivery.
• Malware scan: nothing malicious was bundled.
• Vulnerability scan: no known CVEs in the version you received.

Secure coding is the supplier's job, and you get assurance about it from the supplier through certifications, contracts and audit rights, not through your acceptance test. For cloud providers the comparable evidence is SOC 2 reports: independent audits of their controls.

Go deeper:

• System and organization controls (Wikipedia) — why a SOC 2 report is the evidence to ask a provider for