They could probably use Docker and not allow network access and limit the resources (including time) to do a build. I don't know if their business model would support it but it's technically possible.