[Kye]

This isn't a hypothetical concern.

https://en.wikipedia.org/wiki/ReactOS#Internal_audit

>> "On 27 January 2006, the developers responsible for maintaining the ReactOS code repository disabled access after a meeting was held to discuss the allegations. When approached by NewsForge, Microsoft declined to comment on the incident. Since ReactOS is a free and open-source software development project, the claim triggered a negative reaction by the free software community; in particular, Wine barred several inactive developers from providing contributions[citation needed] and formal high level cooperation between the two projects remained difficult as of 2006.[33] Contributions from several active ReactOS developers have been accepted post-audit, and low level cooperation for bug fixes has been still occurring."

[toyg]

And indeed there is little to do except discharging responsibility:

>> all developers were made to sign an agreement committing them to comply with the project's policies on reverse engineering. Contributors to its development were not affected by these events, and all access to the software development tools was restored

Also relevant:

>> the 2004 leaked Windows source code[38] was not seen as legal risk for ReactOS, as the trade secret was considered indefensible in court due to broad spread.[39]