The hassle of getting engineers to manage the code and keep it up to date isn't worth it (with all the legal gray areas surrounding IP). That's what I was trying to avoid by going the SaaS route in the first place.
YMMV - it will clearly depend on your industry, customer, and likelihood that there'll be a problem anyway.
An agreed escrow company comes in, and we prepare a clean build system. We follow the documentation to build the system and run basic system checks. We show that the binaries just built are identical to those on the customer's running system. Then we power down, remove the disk, and hand it over to the agent who seals it in a labelled bag. We sign, they sign. If the customer wants to be present, they sign as well.
There are many places where the whole thing can be faked, but we don't do that, and the agent does have some skills and abilities to detect such things.