Of course they will, but the actual problem is there. I've been delivering systems where we had to deliver the source environment (ie what is used to build pro

Of course they will, but the actual problem is there. I've been delivering systems where we had to deliver the source environment (ie what is used to build production) into escrow with a lawyer as part of the contract. It effectively required us to prove that what we delivered (both hardware and software) into escrow, would be able to reproduce what was in production, reliably and provably. Reproducible builds are really hard, especially with people encoding CVS/SVN/git tags into the build, compilers and linkers not producing equivalent results between runs (eg caches warm/cold can make a difference) etc etc. It's a real problem and a real issue.