Along with that Grsec then says that if while the patch is GPLv2 if you distribute them they'll never let you subscribe again to get the patch in the future.
Mailing list is not the code.
If he starts filtering on the web server or rejecting direct source requests, he starts violating the letter of GPL 2.
In any case, if what you say is correct, the grsecurity team are still trying to hold the threat of a more annoying experience over their users in order up prevent them from exercising their rights under the GPLv2.
If you take an open source product, modify it and only use it in-house you don't have to provide source code to anyone.