They have access to the patches. They just can't make an official release with it, because they can't publish the patch sources (embargoed) and their releases

They have access to the patches. They just can't make an official release with it, because they can't publish the patch sources (embargoed) and their releases being open-source must match what they published...