The "tipping point" is, everyone who runs your software has the right to see the source code, and do whatever they want with it. So, the contarctor who gets to run your customized version must have the code. But the merger due diligence team does not get to run the code, so they don't have the right to re-distribute.