From what I gather the article seems to indicate an candidate is given access to their code base to 'do a fix' remotely. Is this a viable strategy initially? Learning the application takes time. Also there is some risk that the candidate will run off with the codebase.

I'm sure they've thought of this, but I can see a situation where you default to a 'standard' audition task in it's own sand-boxed environment just to mitigate any theft issues.