> My guess is that there could be some contractual agreement to forbid sharing of the GPLv3 source?

That would negate the GPLv3 itself. What they (the PaX team) can do is provide an exception (like GCC does) to let the client use it while not having their (the client's) own code infected by the GPLv3.

The client would still be entitled to distribute the software they got from the PaX team to another party, which would receive it under the same terms.