If it works out that the first party has to ship a harmful release to everyone and they can only supply that release through a second party in source code form then we are way ahead of the case where there is only one party. A conspiracy involving multiple entities is much harder to get away with than a unilateral action.