Based on DeepDelve's recent follow-up article, I would assume the former. https://deepdelver.substack.com/p/delve-fake-compliance-as-a...

Every layer of the organization tells a more rosy version of the truth up the chain of command. The programmer might tell the PM that they're running Apache software with the serials filed off, but by the time that filters up the chain to the CEO / Board, the product is "fully proprietary and 100% built in-house"