That's exactly it. The contact had flash source but they get the DRM code shipped as a binary library so never see the source of it. A lot of companies, MS, Google, Adobe compartmentalise their drm team, effectively at the behest of the media companies as its all smoke and mirrors anyway. trying to protect things like encryption keys and the like. Typically therefore the binaries are also obfuscated heavily.