They only need to provide the sources for the kernel, not the software running on top of the kernel. Usually they do publish the source for their kernel somewhere on their website in my experience (although they don't always provide a direct link to it on the product).