You still can audit the code for security purposes pretty easily using the tarballs if you were so inclined. While granular commits (of the sort you see with public repos) are useful, they are by no means necessary for this sort of thing.