It works out ok. The GPL only requires Red Hat to provide the source code to its users, not the whole world. A license requiring publication on the internet would be considered non-free by the GNU project. It would also be rejected by Debian because it would fail the Desert Island test [1].
What a massive hole in the GPL, and its wild it would be considered "non-free" when most people would actually consider it free. Another reason I do not like that license.
They can't, but they could do something like GRSecurity, saying that they would end their contract with / stop giving anybody who distributes it further updates.
[1] https://wiki.debian.org/DesertIslandTest