This argument should be turned around. Let me illustrate with an example that is now less contentious.
An incident occurs with a pathogen in, say, Salisbury. As Craig once pointed out, the nearest lab dealing with such pathogens is a reasonable place to suspect a source. So point me to the public databases to see what they were working on there, their previous and current stock levels of associated substances, and the findings of independent inspections, so that we can eliminate that lab.
No such database and only perfunctory inspections, right? Employees not allowed to speak. But if there were, internal vigilance would be much higher, just as a compulsory trial register, compulsory disclosure, and protection of public testimony would raise standards in pharmaceuticals.
It should be an ongoing responsibility of institutions to demonstrate that their work is safe, not the responsibility of public and governments to prove, after an incident, that it was unsafe.