This is a common misconception. They don't have to release them under GPL if they don't distribute the modified version. With SaaS, this is in practice true for any server side code that remains private to the company. Affero GPL addresses this but I haven't seen it much in the wild.