"You can even have and keep changes (unpublished) for you entire organization " -- add to that that the organization should have access to the source code, yes. That doesn't mean that you need to publish the code outside of your organization.

" Even if the instance isn't public, if you so much as have a contractor remotely accessing " -- Correct, now you are distributing the software to the "public" external to your own needs.