Grsecurity creates patches for issues in upstream, but their patches are too fucking big/ugly, so nobody upstream really wants to merge them, and when someone tries to fix em (take the important bits out), grsecurity complains about them using their work.
Grsecurity then say they don't feel like doing a lot of work on their patches when they're not paid to do it.
Mailing list is not the code.
If he starts filtering on the web server or rejecting direct source requests, he starts violating the letter of GPL 2.
In any case, if what you say is correct, the grsecurity team are still trying to hold the threat of a more annoying experience over their users in order up prevent them from exercising their rights under the GPLv2.
If you take an open source product, modify it and only use it in-house you don't have to provide source code to anyone.