What about projects like WINE - now in use by corporations like Valve? Surely someone who's worked on the project must have seen Microsoft/Windows source code.
Sure but the WINE folk don’t really know either way if a contributor who contributes has seen it, unless they do some background checks or their email literally ends with @microsoft.com (even then they could be in another Microsoft team away from Windows)
Of course, but they've insulated themselves as best they can.