Carriers don't have access to the source code AFAIK, correct me if I'm wrong but they can only change the "cellular" part of the phone (baseband, carrier packages, etc).
I think Apple actually customizes the firmware packages for each carrier since they maintain separate versions for ATT/Verizon for each iPhone model...
I don't even have an iPhone nowadays, I'm just curious. :)
Since what CarrierIQ is doing is considered illegal in many countries I'm fairly sure Apple wouldn't want to open themselves up to that type of liability.