You're right, but it's equivalent to publishing because all users can have the source code AND can then distribute it freely once at least one user has it.
There are some potential scenarios where they aren't necessarily equivalent:
Your users don't know what source code is.
Your users don't bother to look at what they downloaded to find the code therein.
Your users aren't developers and they don't know any devs, so having the source isn't useful to them, so even if they see the code they won't redistribute.
Your users find the code a competitive advantage and don't want to spread that around. Its also too expensive for most organisations to obtain the code too.
You deliver binary and source, but then disincentivise redistribution by cutting off access to something else, like updates. This is what grsecurity and RedHat do. There was one leak of grsec, but that quickly became obsolete.
Your users don't know what source code is.
Your users don't bother to look at what they downloaded to find the code therein.
Your users aren't developers and they don't know any devs, so having the source isn't useful to them, so even if they see the code they won't redistribute.
Your users find the code a competitive advantage and don't want to spread that around. Its also too expensive for most organisations to obtain the code too.
You deliver binary and source, but then disincentivise redistribution by cutting off access to something else, like updates. This is what grsecurity and RedHat do. There was one leak of grsec, but that quickly became obsolete.