You’re correct about that the kernel sources have to be released legally.
Quote from support:
I asked the head of the IT team as promised.
She agreed we legally have to release them, and she’s still waiting for our manufacturer to provide them to us.