Why it isn't just in a public repo, I don't know. It looks like it is set up so they can pull it at a moment's notice.
I agree with your comments.
It seems like a snapshotting tool, so you check out the stub and then dump the snapshot into it from the depot.
(this is similar to how Windows is built inside Microsoft).
Everything is in public svn and/or git repositories. The thing that's confusing you is probably how modules are split out as dependencies. They're not checked directly into the tree, and instead are listed by repository URL and pinned revision in DEPS files. On checkout and sync gclient pulls the correct revision from the appropriate repository: http://dev.chromium.org/developers/how-tos/depottools#TOC-DE...