You should see red hat's quarter on quarter growth. Oh, and just create a redhat.com login, it's free and gives you access to all their docs. Or don't.
Only part of rhel is covered by gplv2, so in the scenario you suggest red hat would only have to publish the sources for the gplv2/3/4 bits, and not the whole distribution.
That policy didn't change either. It had been in their licence agreement on their Web site since long before any of this. I also have been told it has never been enforced.
This was an embargoed CVE. Red Hat was working on it before either Rocky or Alma knew about it. The fix hasn't been published by RH because of the level of testing it requires, and the risk associated with screwing up the fix. Alma and Rocky have nothing like such commercial obligations to their users.