Would be interesting to know how other programs function… Eurofighter, NH90, F-35, 787 etc. For example, does Boeing have access to the source code of the 787’s flight control system, or is that proprietary to Honeywell? Does Airbus have access to the source code of the A400M’s FADEC or is that proprietary to Europrop? (Or perhaps BAE Systems as AFAIK they were actually responsible for the TP400 FADEC) etc.
Can't speak for 787, but for 777* we had Boeing engineers embedded in the team, not many, just a couple. IIRC they were operating in a QA role. They'd likely have full access to the code in that case, though I don't know if the source code was a deliverable or not. We were implementing a Boeing requirement - control laws, so they'd have a fair idea what the code said anyway. Even stuff like the GMAv developed redundancy management system, they'd need the details of how it works to go into the flight manuals. FAA were a bit hands off**, so I don't know if they were digging into the software or not.
* Might have been 757 RT, which was a proof of concept, my memory's a bit hazy on where one stopped and the other began, as we moved straight from one to the other.
** By Eurofighter standards, ridiculously hands off.
For Eurofighter, we had fully integrated teams. There was an initial plan to farm work packages out to the Italians and Spanish, but that didn't work, so we ended up with one team in Ottobrunn interfacing with Eurofighter Gmbh and doing requirements and top level design and the main team in Rochester doing hardware, software and testing, people from all four partners in each team, so the visibility to the full software build would be there for each partner company, and our customer, Eurofighter Gmbh, was just another combination of the same partner companies. We also had regular visits from the National Airworthiness Authorities, those usually meant me sitting at my computer for a week with an NAA software QA guy looking over my shoulder saying "Right, show me the evidence that change request XYZ was implemented". I imagine customer QA was also embedded into those reviews, but don't actually recall.
I'd presume the German NAA QA guys came from WTD 61 at Manching, and they're going to want the same kind of access they had on Eurofighter for FCAS, because they're not going to sign off something they don't have full visibility into - especially not with MCAS on everyone's minds. This isn't just 'we're used to this level of access', it's getting towards 'As an engineer I'm legally required to have had access to this in order to be able to sign it off'.
Remember what happened to the UK Chinook HC3s - the UK's technical assessment guys didn't have the access to certify the cockpit software and refused to do so, and we ended up doing a nose-job on them to stick an HC2 cockpit on the HC3 fuselages.