This happens. I've also seen cases where the vendor, by contract, does not permit government staff outside of 1-2 people from viewing the source code.