How does copyleft license work in this case? Aren't they legally required to open-source their sources and publish it publicly or can they hide that behind a request system?
The difference you describe mostly applies to system libraries (those libraries that are not distributed alongside applications).