Curtailed... "Source-only uploads" (the term to Google for) are not required. I suspect they are not even the norm due to not being the defaults for various tools, etc.
It doesn't matter too much... you either trust your contributors or you don't. But it's still a bit icky.