All but the most IP-sensitive code at Google is visible to all Googlers, yes. And being able to tell what code is being executed by what machines in production is required for ops and reliability reasons in any big company anyway. But most important of all, it doesn't make sense to make what's arguably the best private security team write your defenses, to then not use them.