"You can even have and keep changes (unpublished) for you entire organization "
-- add to that that the organization should have access to the source code, yes.
That doesn't mean that you need to publish the code outside of your organization.
" Even if the instance isn't public, if you so much as have a contractor remotely accessing "
-- Correct, now you are distributing the software to the "public" external to your own needs.
" Even if the instance isn't public, if you so much as have a contractor remotely accessing " -- Correct, now you are distributing the software to the "public" external to your own needs.