I've read a suggestion that that actually would violate the assorted open source licenses in question, which generally require some version of giving the user the same source as was used to build the binaries they got. Of course, they might be able to just do it on the more permissively licensed packages.

So all it would take is a couple of separate releases of the SC, and you can diff to see the changes.

Yeah, a few well intentioned people could buy copies of RHEL and compare source code releases.

If they haven’t already, I’m sure you could expect them to. That’s the only way to really police the policy.