> A few years ago the ReactOS developers had to stop all development for several months to perform a source code audit.

What kind of an audit can you do without access to the original software's source code? How would you tell if it's actually different?

This is what they did https://www.reactos.org/wiki/Audit

That's pretty cool, thanks!

That's unfortunate and doesn't fit my understanding of the situation - is disassembling a binary not fair game, in the same way that Samsung buying an iPhone and cracking it open is? (Assuming we're worried about copyright and not patents).

IANAL, but as far as I understand the situation it is not. See https://en.wikipedia.org/wiki/Chinese_wall#Reverse_engineeri...

But IIUC, clean room reverse engineering requires substantial effort to prove you did not take any shortcuts.