Don't know if it's what GP means but without a clear contract there's room for the paid work to be considered "work for hire" which means the company owns the change and OP wouldn't be able to incorporate it into the open source version of the project.

Obviously the contract needs to specify the license.

Obviously. And yet these things are left un-/under-specified all the time.

if the company uses the original product under a GPL license, then any changes they make (or pay the original developer (or anyone else) to make) have to be GPL too. the company would still own the copyright for that code, but it would be no different from any other contribution to the project.

if the company uses the product under a different license, then making the change public would have to be negotiated. a consideration for the company among others is that the company thinks that the change would be a competitive edge they would like to keep themselves (although most often that is an illusion, and the extra cost of maintaining that branch is not worth the advantage. this is something the developer needs to communicate)

if the nature of the changes make maintaining a separate branch difficult then i would make it clear up front that such a change can only be made if it is incorporated in the FOSS version of the product.

alternatively, i remember from the early days of zope, one of the project owners told me that they would offer companies a 10% discount if they would allow them to make the change public.

Only if they distribute the software.

that is technically correct, but what is distribution in the context of complex business relationships is not clear. even giving software to a contractor to work on could be considered distribution, so if the software is GPL then it is safer to just assume that any changes are going to have to be GPL too. if you do not want that then you better make sure you get the software under a license that does not risk your paid changes being under GPL.