...they're not distributing it under the GPL. Which would involve offering their clients source or offering source to any third party at a charge no greater than the cost of offering this source.

Internal use of modified GPL code is fine. Distribution to clients, at a fee, triggers source disclosure.

A secondary question is what heed is being given to security -- VNC traffic by default is not encrypted in transit unless tunneled through another protocol.