I wouldn't be surprised if this included the source code of everything that ships with the device, but I'd think it doesn't extend to server-side code.

The actual implementation is important here. Does the Chinese government require the companies send them a tarball or just the opportunity to inspect it on the companies terms?

If it's the latter, I can see all kind of companies complying. It's not unheard of to allow code inspection and auditing by setting up a secure PC with the code with all the USB ports epoxied shut and no network connection. The inspector using it can read and take notes, but the notes have to be reviewed and cleared by the company before they can be taken away.