They still provide all the sources, as well as easy means to build them ( a source rpm ). This is far more than what the GPL requires them to do. What they don't distribute is the srpm with all of the patches neatly broken out by bug number and CVE (if applicable).

It makes it harder to figure out what sources came from RH, and what are vanilla kernel sources, but there's nothing in the GPL that says you have to detail the provenance of every line of source code distributed