If they haven't done modifications to BusyBox (or other GPLed software), they don't need to provide the source themselves. They can simply point people to the homepage (counts as 3rd party server).