the more important question is usually whether people outside the core dev team can (practically and legally) rebuild from modified source

Agreed ofc but it's still only one company.