The claim here that their sources are available seems like it probably has a lot of asterisks to it? Or is this kerfuffle really over nothing?

McGrath seems to be fessing up to removing access to binaries, and has his hard-truth he wants to try to deal, but but it seems like the story goes significantly deeper or the anger/frustration wouldn't be anywhere near as high. It's not clear to me from a quick browse of the repo what backports/security fixes are/aren't available.