Yeah, you'd have to assume they are parsing and normalizing this data in some way. There would still be some AST patterns or something similar you could look for in the same way, but it would be much trickier.

Plus considering this is a legal issue ... good luck with "there is a statistically significant similarity in AST outputs related to the most unique sections of this code base" type arguments in court. We're currently at the "what's an API" stage of legal tech understanding.