That's true in general but if the code will run on their servers, they have a responsibility to review it themselves.