It is up to them to make sure that they are following NDAs. Also, sometimes code isn't open source, and it isn't NDA; like 4th year assignments or small contracts.